SAST source analysis
On this page
SAST reviews code in a pinned repository revision in Workbench. It gives you source-level evidence; it does not test a deployed application. Use DAST when you need to assess behavior at an authorized live target.
#Inputs
Add the approved repository under Source repositories using its repository URL or path. In Assessment setup, select that project repository and enter its full commit hash. Review and save that exact revision before starting source analysis. Workbench rechecks the selected revision before the run. See SAST languages and source files for the supported file families and classification guidance.
#What results mean
A source candidate must cite a file, line, and snippet. Workbench validates and traces candidates before storing them as findings. A language label or generated explanation by itself is not a confirmed vulnerability. Findings describe the selected source revision, not necessarily behavior in a deployed build.
#Review and remediation
Open the finding and compare its evidence with the pinned source. Confirm the code path and application context, then decide whether to change the code and run source analysis again. Use an authorized live assessment when you need runtime evidence.
#Availability
SAST is included in the Professional package. See Plans and licensing for package details. Access is arranged by email; request access.
#Related guides
Need a workflow that is not documented here? Email contact@eresussec.com.