SAST source analysis

SAST reviews an authorized source snapshot in Eresus Workbench. It is a source workflow, not a live-target DAST assessment.

Source analysis setup: repository URL, connected source, or upload

Inputs

Start Source analysis in Workbench and provide one approved source input:

A credential-free HTTPS repository URL
A connected repository source
An uploaded source archive

Workbench asks the operator to confirm Source, Policy, then Review & launch. The run is tied to the source snapshot chosen at launch; it does not silently expand into a live endpoint assessment.

What the analysis reviews

Language-aware research covers the source files recognized in the selected snapshot. The analysis ranks security-relevant paths such as handlers, routes, authentication, upload, CI, Terraform, and configuration files. Binary, generated, lock, vendor, build, and other excluded files are not treated as source evidence.

See SAST languages for the language families, classification order, and file exclusions.

Evidence and review

A candidate must cite a real file, line, and snippet. Candidates are then validated and traced before storage as findings. A source pattern, language label, or model-generated explanation is not itself a confirmed vulnerability.

SAST evidence describes the source snapshot. It does not replace runtime testing for behavior that only exists in a deployed application.

Safety boundary

Source research agents work on the pinned clone or uploaded snapshot. They can list, search, and read that source; they do not receive shell, network, package-audit, third-party-scanner, or write access.

Availability

SAST is included from the Professional package. Agent-assisted source follow-up and patch suggestions require higher eligible packages. See Plans for the current package matrix.

Need a workflow that is not documented here? Email contact@eresussec.com.