sast-configuration

原文涵盖的主题

• SAST Configuration
• Use this skill when
• Do not use this skill when
• Instructions
• Safety
• Overview
• Core Capabilities
• 1. Semgrep Configuration

Static Application Security Testing (SAST) tool setup, configuration, and custom rule creation for comprehensive security scanning across multiple programming languages. Set up SAST scanning in CI/CD pipelines Create custom security rules for your codebase Configure quality gates and compliance policies Optimize scan performance and reduce false positives Integrate multiple SAST tools for defense-in-depth You only need DAST or manual penetration testing guidance You cannot access source code or CI/CD pipelines You need organizational policy decisions rather than tooling setup 1. Identify languages, repos, and compliance requirements. 2. Choose tools and define a baseline policy. 3. Integrate scans into CI/CD with gating thresholds. 4. Tune rules and suppressions based on false positives. 5. Track remediation and verify fixes. Avoid scanning sensitive repos with third-party services without approval. Prevent leaks of secrets in scan artifacts and logs. This skill provides comprehensive guidance for setting up and configuring SAST tools including Semgrep, SonarQube, and CodeQL. Custom rule creation with pattern matching Language-specific security rules (Python, JavaScript, Go, Java,

这里只展示节选，请以完整原文和当前要求为准。