Introduction
Understanding organizationsUnderstanding componentsManage organizationsManage componentsManage component Jira integrations
Set up your first organizationUnderstanding users and teamsUnderstanding role-based access controlManage usersManage teamsConfigure role-based access controlRBAC permissions reference
Understanding authentication in CloudBees UnifySet up multifactor authenticationConfigure SAML single sign-onConfigure OIDC authenticationConfigure network security policiesNetwork security reference
Understanding platform configurationUnderstanding environmentsManage properties and secretsManage environmentsTrack environment inventoryConfigure containersSet up preconfigured actionsConfigure notifications
Accessibility policy referenceShared responsibility model referenceSubscription and services agreementSupport policiesSupported browsers and external tools
Introduction
Understanding feature managementUnderstanding Configuration as CodeGet started with feature managementCreate and manage feature flagsConfigure feature flag targetingOrganize feature flagsImplement feature flag governanceConfiguration as Code reference
Understanding flag impressions and activity statusUnderstanding flag healthUnderstanding code referencesReview and clean up feature flagsSet up code references
Understanding Jira integration for feature flagsSet up the Jira integrationLink Jira tickets to feature flags
Understanding multiple SDK keysBuild your first mobile app with feature flagsBuild your first feature-flagged web applicationBuild your first feature-flagged backend serviceInstall client-side SDKsInstall server-side SDKsConfigure multiple SDK keysMobile SDK referenceWeb SDK referenceBackend SDK referenceClient SDK referenceFlag implementation reference
Introduction
Understanding CI workflowsCreate a build workflowCreate and manage workflowsCreate reusable workflowsTest and validate containers in workflowsCheck out source codeTrigger workflows remotelyWorkflow syntax referenceJobs syntax referenceSteps syntax referenceServices syntax reference
Monitor workflow runsView test results in runsView evidence in runsView deployments in runsManage workflow artifactsPublish test resultsPublish evidence itemsGenerate a software bill of materialsManage ServiceNow change requests
Configure workflow credentialsConfigure AWS credentialsConfigure container registry credentialsConfigure Git credentialsIntegrate external secret providers
Understanding GitHub Actions integrationSet up GitHub Actions integrationDisplay GitHub Actions workflows and runsRegister GHA build artifactsPublish GHA deployed artifactsPublish GHA test resultsPublish GHA evidence itemsTrigger CloudBees workflows from GitHub ActionsScan with GitHub Actions
Understanding CloudBees CI and Jenkins® integrationConnect CI and Jenkins controllersMonitor CI and Jenkins buildsRegister CI build artifactsRegister CI deployed artifactsPublish CI test resultsConfigure CI security scanningCI and Jenkins integration reference
Build and publish container imagesUnderstanding external CI/CD integrationsRun external CI/CD jobsExternal CI/CD action reference
Introduction
Understanding release orchestrationManage applicationsCreate deployer workflowsCreate staged workflowsCreate and manage releasesOrchestrate multi-workflow releasesRelease management reference
Understanding artifact managementRegister and track artifactsStore and retrieve artifactsPromote artifactsGenerate a software bill of materialsArtifact management reference
Deploy with HelmDeploy to KubernetesContainer deployment reference
Deploy to AWSAWS deployment reference
Deploy with enterprise platformsExecute remote deployment commandsEnterprise deployment reference
Verify deployments with New RelicDeployment verification reference

Configure SAST scanning

3 minute read

Configure static application security testing (SAST) scanning to automatically detect security vulnerabilities and code quality issues in your source code during the development process. SAST scanning analyzes source code wiithout executing it, identifying potential security flaws, coding errors, and adherence to security best practices across multiple programming languages. Before you begin, ensure you have component management permissions and access to the security tools you want to configure.

Choose your SAST scanning approach

CloudBees Unify supports two approaches for SAST scanning: implicit scanning through application security posture management (ASPM) and explicit scanning through workflow actions.

To choose the right approach:

  1. Determine your scanning needs:

    • Choose implicit scanning for continuous security monitoring that automatically triggers when components are created or code is committed

    • Choose explicit scanning for custom workflow integration with specific scan timing and configuration control

  2. Identify your programming languages and technology stack to select compatible SAST scanners from the available options

Your choice affects which configuration steps to follow in the subsequent sections.

Configure implicit SAST scanning

Implicit SAST scanning integrates with ASPM to provide automatic security analysis across your application portfolio.

You must have ASPM enabled for your organization and the Manage security tools permission to configure implicit scanning.

To configure implicit SAST scanning:

  1. Navigate to Security  Marketplace in your organization

  2. Filter the available tools:

    • Select SAST from the Category filter, or

    • Search for specific scanner names in the search field

  3. Select and activate your chosen SAST scanner(s) by selecting the toggle switch from the available implicit scanners:

    • Checkov: Infrastructure as Code (IaC) security scanning

    • Gitleaks: Git repository secret detection

    • Gosec: Go-specific security analysis

    • Klocwork: Enterprise SAST for Java, C++, C#, and Python (requires configuration)

    • njsscan: Node.js security analysis

    • SCC Scanner: Language analyzer (enabled by default)

    • Snyk IaC: Infrastructure as Code security analysis

    • Snyk SAST: Comprehensive multi-language SAST analysis

    • FindSecBugs: Java binary security analysis

      Additional implicit scanners for binary analysis include Grype, Syft SBOM, and Trivy.

      The system activates the selected scanners for all components in your organization hierarchy.

  4. Configure scanner-specific settings if required:

    • Access individual scanner configuration through the Marketplace

    • Set file inclusion or exclusion patterns as needed

    • Configure severity thresholds and reporting preferences

      Scanner configuration options vary by tool. Refer to individual scanner documentation for detailed configuration guidance.

Once configured, implicit scanning automatically analyzes code when you create components or commit changes to linked repositories.

Configure explicit workflow SAST scanning

Explicit workflow SAST scanning provides granular control over when and how security analysis runs within your CloudBees Unify workflows.

To configure explicit workflow SAST scanning:

  1. Add SAST scanning actions to your workflow YAML file in the appropriate job step. Available explicit SAST scanners include:

  2. Configure scanner authentication and credentials:

    • Create the required secrets in your CloudBees Unify organization or component settings

    • Set up API tokens, server URLs, and organization names as required by your chosen scanner

      Common authentication patterns include:

      • Token-based: Most scanners require API tokens stored as secrets

      • Server URL: Some enterprise scanners require custom server endpoints

      • Organization context: Many scanners require organization or account identifiers

  3. Customize scan parameters for your specific needs:

    • Define file inclusion or exclusion patterns using scanner-specific syntax

    • Set scan timeout values appropriate for your codebase size

    • Configure result output formats and reporting options

      Example with custom parameters:

      - name: Scan with Mend SAST
  uses: https://github.com/cloudbees-io/mend-sast-scan-code@v1
  with:
    server-url: ${{ vars.MEND_SERVER_URL }}
    token: ${{ secrets.MEND_SECRET }}
    language: "LANGUAGE_PYTHON"
      ▼
Explicit scanning requires manual workflow configuration and maintenance. Ensure your team has the expertise to manage scanner updates and configuration changes.

For detailed information about SAST scanner inputs, usage examples, and language support, refer to SAST scanner reference.

Use multiple complementary scanners to achieve comprehensive coverage across different languages and security analysis approaches in your codebase.

Review and manage SAST findings

After configuring SAST scanning, access and manage your security findings through the CloudBees Unify Security Center.

To review SAST findings:

  1. Navigate to Security  Security Center in your organization

  2. Select the appropriate view:

    • Component Security Center for component-specific findings

    • Application Security Center for application-level security posture

  3. Review findings by severity level, scanner type, and remediation status

  4. Use the triage workflow to prioritize and track remediation efforts

Results from explicit scanner actions also appear in the security insights dashboard under Analytics  Security insights. For more information, refer to Investigate security insights.

For detailed guidance on findings management, refer to Triage security findings.

Related pages

Get started with security scanning
Configure DAST scanning