Static Code Analysis

Static Code Analysis scans a Git repository or an uploaded ZIP archive. Several engines run on the same checkout, and you choose them on one page:

The form starts with the AI engines on and the classic scanners off. Scans can run once, on a schedule, or whenever a branch changes.

Before you start

Run a scan

1. 01
   Open Static Code Analysis in the sidebar

   The Static Analysis page opens.

2. 02
   Give it the code

   Git Repository tab: enter one or more repositories in Repositories. Or Upload ZIP tab: drop a .zip of the source.

3. 03
   Choose the Scanning Mode

   Full scan to scan everything now. The line under the field says what the chosen mode will do.

4. 04
   Choose the Main Language

   All supported languages (the default) suits most repositories; choose one language to run its native engine with Full in a partial scan.

5. 05
   Choose the Product Assignment

   The product the findings are filed under.

6. 06
   Review the scanner switches

   AI Featured Code Analysis on the right, Classic SAST Scanners below it. Open a row to see its options.

7. 07
   Click Start Analysis

Check it worked: a single scan shows Scan submitted and opens its scan page, where you follow it stage by stage (see The scan page). A batch of repositories shows N scan submitted, lists any repository that was not submitted with the reason, and opens Scan History.

zoom_inEnlarge

Read https://scansuite.eu/documentation/usage/static-code-analysis. Install the ScanSuite skill from github.com/cepxeo/scansuite-ci, then run an AI Native SAST scan of this repository against the ScanSuite product <PRODUCT> and summarise the critical and high findings. SCANSUITE_URL, SCANSUITE_TEAM and SCANSUITE_TOKEN are already set in the environment; never ask me for the token and never print it. If the product does not exist or the token is refused, stop and tell me what a person has to do.

The same scan can run from a pipeline with scansuite-ci (CI/CD and automation) or from a coding agent with the ScanSuite skill (Working with AI agents).

The form, field by field

When you enter a single repository, a line under Repositories shows what its last finished scan spent: the date, the LLM tokens and calls and, once models are priced, the cost.

When fix verification is switched off for the team, Findings to verify says so: the run will reassess the findings but not close any. See Rescans and fix verification.

Scanners and their defaults

A scanner whose images this server lacks is marked Not installed on this server. and cannot be chosen; a Main Language whose engine runs without CodeQL here says Runs without CodeQL: not installed on this server. See Scan outcomes in Managing scan execution.

The form remembers your choice. Each time you submit, your scanner selection, Main Language and Branch Name are saved as your preference in this team, and the next visit preselects them. The defaults above apply only until your first submission. Turning a scanner off clears its options.

Language coverage

AI Native SAST reads more than 30 languages. Twelve of them also have a native engine, which the Full scanner runs for the language chosen in Main Language:

• With All supported languages, a Full scan of the whole repository runs the native engine of every language it finds, and AI Native SAST reads every language in the table.
• In Incremental Scan, Monitor Changes and Custom Scope, All supported languages runs no native engine; the scan log says select one language to run its engine on this scan. Choose the language if you need its engine there.

Scanning modes

zoom_inEnlarge

• Choosing Custom Scope or Verify Fixes switches off Secrets Detection, Dependency Check, Analyze Git history and Cross-file hunt, because they look beyond the listed files. Only AI Native SAST, Quick, Full, Custom Rules and IaCS Analysis accept a file list.
• Schedules and monitors are managed on the Schedules page; see Schedule the scan. Monitoring and incremental scans are explained in Monitored branches and incremental scans.

zoom_inEnlarge

Where the results go

Findings of the classic scanners (Semgrep in Quick, Full and Custom Rules; KICS in IaCS Analysis; and Dependency Check without reachability) are also stored on the Vulnerabilities page while Teams → Scanning → Store scanner findings is On (the default), from the severity set there (Medium by default). See Set up DefectDojo for DefectDojo.