Static Code Analysis
Analyse a repository or an archive: AI Native SAST, secrets, dependencies and the classic scanners.
Static analysis in ScanSuite covers several distinct engines, all configured on one page and all running against the same checkout:
| Engine | What it does |
|---|---|
| AI Native SAST | A model reads each file in scope and reports what it finds, then a reachability agent decides whether the finding is actually reachable. |
| Secrets Detection | Finds exposed keys, tokens and credentials — optionally with the model judging which are real. |
| Dependency Check (SCA) | Maps third-party libraries to known CVEs, optionally gated by whether your code can reach them. |
| Classic SAST scanners | Quick and Full application scanning, your own rules, IaC analysis and Snyk. |
| IaCS Analysis | Reviews Terraform, Kubernetes and cloud configuration risks. |
| AI Code Documentation | Generates a security-oriented tutorial of the codebase. |
Scan types supported
Both on-demand and scheduled scans are supported. Additionally you can configure repository monitoring to check a branch for updates and automatically run an incremental scan on the changes. See Scheduling periodic and incremental scans.
Step by step
- 01Create a product
Before initiating a scan, create a product as described in the Products chapter.
- 02Provide the source code
Either upload a ZIP archive containing one or more source directories, or specify a Git repository URL. Both HTTPS and SSH formats are supported.
- 03Open the Static Analysis tab
Upload the archive or enter the repository path, then select the main programming language of the project.
If the repository requires authentication, set that up first — Git repository authentication.
Choosing engines
Language-specific scanners are triggered automatically based on the Main Language you selected. Choosing All supported languages is the right option for a polyglot repository.
On the same page you then choose:
- Additional multi-language scanners and extra features, such as AI code documentation.
- Which scan results should be exported to DefectDojo — this is a per-scanner checkbox.
- Which AI features to enable:
- AI Native SAST, with optional Verify findings reachability, Analyze Git history and Analyze security architecture
- Verify secrets with AI
- Enrich findings details with AI and Verify findings reachability for the dependency check
Scope
The Scanning Mode dropdown offers Once, Daily, Weekly, Monthly, Monitor Changes, Incremental Scan and Custom Scope. Custom Scope takes a list of file and folder patterns, so you can point an expensive AI pass at the code that matters rather than the whole tree.
AI analysis is priced per token, so scope is the main cost control you have. Custom Scope, Incremental Scan and Monitor Changes all exist to keep a re-scan proportional to the change rather than to the size of the codebase.
Submitting
Confirm that the Product / Engagement ID matches the one created during product setup, then click Submit.
Follow the scan from Scan History.
Last reviewed 2026-08-16