SAST

JFrog Advanced Security SAST engine is a local, fast, and accurate static application security testing solution that enables developers to identify and fix security issues early in the development process. Our solution runs directly on your local environment, minimizing delays and maintaining data privacy. It is designed for developers, with out-of-the-box functionality, low false positives, and easy integration into your workflow.

Key Benefits of JFrog SAST

• Speed & Efficiency: JFrog SAST runs locally on developers’ machines and CI servers, scanning at a speed of approximately 2,000 lines of code per second. This enables rapid scans while maintaining high-quality analysis and low false positive rates, thanks to its cross-file and data flow analysis.
• Accuracy: Our SAST engine performs comprehensive cross-file analysis, tracing the data flow from the source to the sink. This allows us to accurately detect vulnerabilities while minimizing noise and false positives. Our proprietary fingerprint algorithm ensures that vulnerabilities marked for ignore won’t reappear due to irrelevant code changes like spaces or new lines—an issue many competitors face.
• OWASP Top 10 & Beyond: JFrog SAST covers the OWASP Top 10 vulnerabilities and goes beyond by identifying additional critical security risks, helping developers secure their code at the earliest stages.
• Developer-Centric: With zero configuration required out of the box, JFrog SAST integrates seamlessly into your workflow through IDE plugins, CLI tools, and Frogbot. It gives developers easy access to actionable findings without interrupting their development process. Security experts can also configure policies and watches to prioritize specific vulnerabilities for enforcement.
• Local Security: JFrog SAST runs locally on your environment, ensuring that source code remains secure and does not need to be uploaded to external services for analysis. This maintains the privacy of your codebase.

How JFrog SAST Outperforms Competitors

• Integration with CI/CD, Securely, and with Privacy: JFrog SAST integrates deeply into CI/CD pipelines, supporting multiple DevOps tools without requiring cloud-based services. It can run locally on your workstation or CI server, making it ideal for air-gapped and self-hosted environments.
• Low False Positive Rate: Thanks to the cross-file analysis, JFrog SAST reduces the number of false positives and ensures that only genuine security risks are flagged. Developers no longer have to sift through irrelevant findings.
• Accurate Fingerprint Algorithm: Our fingerprint algorithm ensures that once a vulnerability is marked as ignored, it won’t reappear in subsequent scans, even if non-relevant code changes occur (such as spaces or newlines). This eliminates the need for security experts to repeatedly reassess triaged issues previously.
• Data Flow Analysis: JFrog SAST tracks the flow of data within your code, providing visibility into how vulnerabilities propagate from source functions to sinks. This enables both developers and security experts to quickly identify and understand potential security risks.
• Actionable Fixes: Each vulnerability is accompanied by clear, actionable steps on how to fix or mitigate the issue. Developers can follow these steps to quickly resolve vulnerabilities and enhance the overall security of their code.
• Customizable Policies: Developers can configure severity thresholds and apply specific policies to decide which vulnerabilities trigger alerts. This customization gives teams more control over their scanning process, ensuring that only the most critical issues are prioritized.

Prerequisites

Language support

Analysis capabilities

Understanding the dependencies in the code (call flow, type propagation, constants, etc.) in the full-project context:

• Cross-functional
• Cross-file
• Cross-module

Querying capabilities (custom queries)

📘

This feature is in Beta and subject to changes.

Ability to construct code queries based on types, constants, external API names, data reachability, control flow dependencies, etc. of unlimited complexity.

List of SAST Rules

JFrog SAST offers a comprehensive set of rules designed to identify security vulnerabilities across your codebase. These rules are mapped to the OWASP Top 10 vulnerabilities, as well as additional critical security issues beyond the OWASP Top 10. The mapping provides clear visibility into which specific vulnerabilities are being addressed and how they align with widely recognized security standards. In this section, you’ll find a detailed table of the SAST rules, and their corresponding OWASP categories, helping you better understand how JFrog SAST ensures your code is protected against the most critical security risks.

• Python
• Java
• JavaScript
• Go
• C/C++
• C#
• Rust
• PHP

Python

Java

JavaScript

Go

C/C++

C#

Rust

PHP