Rationale
Static Application Security Testing (SAST) finds vulnerabilities in source code without executing the application. GitLab mandates SAST for all projects.
Enforcement
- SonarQube: Security hotspot and vulnerability rules
Requirements
- SAST must run on every CI pipeline
- No new Critical or High severity findings allowed in new code
- Medium findings must have documented justification or remediation plan
- False positives must be explicitly suppressed with justification
Common Vulnerability Categories
| Category | Examples |
|---|---|
| Injection | SQL, LDAP, OS command injection |
| Authentication | Weak password policies, missing MFA |
| Sensitive Data | Unencrypted PII, log injection |
| Cryptography | Weak algorithms, hardcoded keys |
| XXE | XML External Entity processing |
References
- GitLab SAST: https://handbook.gitlab.com/handbook/security/product-security/secure-coding-training/
- Application Security Review: https://handbook.gitlab.com/handbook/security/product-security/application-security/