Static Application Security Testing (SAST)

For Executives

Codepure SAST scans your source code for security vulnerabilities before they reach production. It works with 22 programming languages, including enterprise platforms like SAP ABAP, COBOL, Salesforce Apex, and Solidity smart contracts — languages that most security tools cannot read. Every finding includes a complete attack trace that shows exactly how user input reaches a dangerous operation, so your developers know what to fix and why. The engine ships with built-in compliance mapping for PCI DSS, GDPR, HIPAA, and Gulf frameworks (NCA ECC, SAMA), so your audit reports are ready from day one.

22 languages — from JavaScript and Python to ABAP, COBOL, and Solidity
Complete attack traces — every finding shows source to sink, not just a pattern match
Built-in compliance — PCI DSS, GDPR, HIPAA, NCA ECC, SAMA mapped automatically
Zero infrastructure — one binary, no dependencies, runs on-premises or air-gapped
Secret detection included — 34 pattern types scan all file types for hardcoded credentials

What SAST Does

Static Application Security Testing analyzes your application’s source code without running it. It reads every file, builds a structured understanding of the code, tracks how data moves through the application, and flags any path where untrusted user input reaches a dangerous operation without being sanitized first. This catches SQL injection, command injection, cross-site scripting, path traversal, server-side request forgery, insecure deserialization, XXE, hardcoded secrets, and dozens of other vulnerability types — before the code is ever deployed.

How Codepure SAST Works

Codepure uses a taint-propagation analysis engine. Instead of looking for code that resembles a vulnerability, it follows the actual flow of data through the application. Step 1 — Source Detection The engine identifies where untrusted data enters the application: HTTP request parameters and headers, file uploads, environment variables, database reads, API responses, message queue payloads, CLI arguments. Step 2 — Taint Propagation Tainted data is tracked through variable assignments, function calls, object properties, array indices, method chains, and return values. The engine follows data across file and module boundaries using inter-procedural analysis. Step 3 — Sanitizer Recognition When tainted data passes through a validation or encoding function — htmlspecialchars() in PHP, $wpdb->prepare() in WordPress, PreparedStatement in Java, parameterized queries in .NET — the taint is cleared. The engine understands language-specific and framework-specific sanitizers. Step 4 — Sink Matching The engine identifies dangerous operations where tainted data causes harm: SQL execution, command execution, file system operations, outbound HTTP requests, XML parsing, deserialization. Only findings where unsanitized data reaches a sink are reported. Step 5 — Attack Trace Generation Every finding includes a complete source-to-sink chain with line numbers, code snippets, and variable names at each step. This tells developers exactly where the vulnerability is and how to fix it.

Vulnerability Categories

Codepure detects the following vulnerability types across its supported languages. Each category includes multiple detection rules tuned for specific frameworks and patterns.

Category	CWE	Description
SQL Injection	CWE-89	Unsanitized input in SQL queries, ORM raw queries, EF Core FromSqlRaw, Sequelize raw queries, dynamic SOQL/SOSL
NoSQL Injection	CWE-943	User input in MongoDB/Mongoose queries, Sequelize where clauses, DynamoDB expressions
Command Injection	CWE-78	Unsanitized input in OS command execution — `system()`, `exec()`, `ProcessBuilder`, `child_process`, `Runtime.exec()`
Code Injection	CWE-94	User input passed to `eval()`, `Function()` constructor, `call_user_func()`, `include` with variable paths, `source` in shell
Cross-Site Scripting (XSS)	CWE-79	Reflected, stored, and DOM-based XSS through unsanitized response output, `innerHTML`, `document.write()`, framework equivalents
Path Traversal	CWE-22	Directory traversal through unsanitized file paths in file read/write/stream operations
Server-Side Request Forgery (SSRF)	CWE-918	User-controlled URLs in outbound HTTP requests, `URL.openStream()`, HTTP client methods, `curl`/`wget` with variable input
XML External Entity (XXE)	CWE-611	XML parsing with DTD processing enabled — `XmlReader`, `DocumentBuilder`, `libxml`, `XElement.Parse`
Insecure Deserialization	CWE-502	Deserialization of untrusted data — `ObjectInputStream`, `BinaryFormatter`, `pickle.loads()`, `unserialize()`, `Yaml.load()`
LDAP Injection	CWE-90	Unsanitized input in LDAP query filters through `DirectorySearcher`, `LdapConnection`, Spring LDAP templates
Remote File Inclusion	—	Dynamic file inclusion with user-controlled paths in PHP, .NET, and Java
Local File Inclusion	—	File read operations with user-controlled paths allowing access to sensitive system files
Open Redirect	CWE-601	User-controlled URLs in redirect operations — `PageReference`, `redirect()`, `Response.Redirect()`
Hardcoded Credentials	CWE-798	Passwords, API keys, tokens, and secrets written directly in source code
Broken Cryptography	CWE-327	Use of deprecated algorithms — DES, 3DES, SHA-1, MD5 — and weak encryption modes like ECB
Weak Random Number Generation	CWE-338	`Math.random()`, `java.util.Random`, `mt_rand()` used in security-sensitive contexts
Cleartext Transmission	CWE-319	HTTP instead of HTTPS, unencrypted network requests, cleartext storage of sensitive data
Sensitive Data Exposure	CWE-200	Stack traces in responses, environment variables in logs, sensitive data to clipboard, unmasked output
Log Information Leakage	CWE-532	Passwords, tokens, and sensitive data written to application logs
Buffer Overflow	CWE-120	`strcpy`, `strcat`, `memcpy` without bounds checking in C/C++
Out-of-Bounds Read/Write	CWE-125 / CWE-787	Unsafe array access and assignment in C/C++ kernel code
Use After Free	CWE-416	Accessing memory after `kfree`/`vfree` in C kernel code
Double Free	CWE-415	Calling `free()` twice on the same pointer
Format String Vulnerability	CWE-134	User-controlled format strings in `printf`/`fprintf`
Type Confusion	CWE-843	Unsafe type casts in C/C++ kernel code
Privilege Escalation	CWE-732	`sudo`/`su` usage in shell scripts with variable input
Insecure Direct Object Reference	CWE-639	Unauthorized data access through manipulated object identifiers
Broken Access Control	CWE-284	Missing authorization checks on insert/update/delete operations (Apex), unprotected administrative endpoints
JWT Weaknesses	CWE-347	Hardcoded JWT secrets, algorithm confusion (HS256 vs RS256), `jwt.decode()` without verification
Insecure Certificate Validation	CWE-295	Disabled TLS certificate verification in network requests
Insecure Biometric Authentication	CWE-287	Weak biometric auth implementations in mobile apps (Dart/Flutter)
Insufficient Session Expiration	CWE-613	Sessions that do not expire or use weak expiration logic
CRLF Injection	CWE-93	User input injected into HTTP headers through carriage return/line feed sequences
Prototype Pollution	CWE-1321	User-controlled property names in JavaScript object assignment
Server-Side Template Injection	CWE-94	User input rendered directly in template engines — Twig, Jinja2, Blade, Thymeleaf, EJS
SOQL/SOSL Injection	—	Dynamic SOQL/SOSL queries with string concatenation in Salesforce Apex
ABAP Native SQL Injection	—	Unsanitized input in `EXEC SQL` and dynamic Open SQL WHERE clauses
ABAP Missing Authority Checks	—	Database operations without `AUTHORITY-CHECK` in ABAP programs
COBOL Arithmetic Overflow	—	Arithmetic operations without `ON SIZE ERROR` handling
COBOL Buffer Overflow	—	`MOVE` without length check, `UNSTRING` overflow
CI/CD Pipeline Misconfiguration	—	Unpinned actions, hardcoded credentials in workflows, insecure OIDC config, running as root, missing approval gates

Supported Languages and Frameworks

Codepure scans 22 programming languages with framework-specific detection rules built from real-world code patterns.

JavaScript / TypeScript

Node.js, Express, Fastify, Koa, Hapi, NestJS, Next.js, Nuxt, React, Angular, Vue.js, Socket.IO, Apollo GraphQL, Sequelize, Mongoose, Prisma, TypeORM

Python

Django, Flask, FastAPI, Pyramid, Bottle, Tornado, Celery, SQLAlchemy, Pandas, Jinja2

PHP

Laravel, Symfony, WordPress, Drupal, Magento, CodeIgniter, Slim, CakePHP, Yii, PHPMailer

Java

Spring Boot, Spring MVC, Spring Security, Spring Data/JPA, Jakarta EE, Apache Struts, JSF (JavaServer Faces), Hibernate, JPA, MyBatis, Micronaut, Quarkus, Eclipse Vert.x, Apache Camel

C# / .NET

ASP.NET Core MVC, ASP.NET Core Web API, ASP.NET Core Minimal APIs, ASP.NET Web Forms, ASP.NET Framework (Legacy), Blazor, Entity Framework Core, Entity Framework (Legacy), Dapper, WCF (Windows Communication Foundation), SQLite (System.Data.SQLite)

Go

net/http (standard library), Gin, Echo, Fiber, Gorilla Mux, Chi, GORM, sqlx, gRPC

Ruby

Ruby on Rails, Sinatra, Padrino, Devise, ActiveRecord, Sidekiq

Kotlin

Spring Boot (Kotlin), Ktor, Android SDK, Exposed, Anko

Scala

Play Framework, Akka, Slick, Cats, ZIO

Groovy

Grails, Gradle Plugins, Jenkins Shared Libraries, Spock, Groovy Templates

Swift

iOS SDK, SwiftUI, UIKit, Vapor, Kitura, Combine

Dart / Flutter

Flutter, Dio, http package, sqflite, Firebase, Provider, Riverpod, WebView (webview_flutter)

Rust

Axum, Actix, Rocket, Warp, Tokio, Serde, Diesel, sqlx

C

Linux Kernel, POSIX/glibc, Embedded Systems

C++

STL, Boost, Qt, Embedded Systems

Solidity

Ethereum Smart Contracts, OpenZeppelin, Hardhat, Truffle

Salesforce Apex

Salesforce Core, Lightning Web Components (LWC), Aura Components, DML Operations

SAP ABAP

SAP ECC, S/4HANA, BSP (Business Server Pages), Web Dynpro, RFC/BAPI

COBOL

IBM Mainframe, CICS, DB2, VSAM

Bash / Shell

Bash, sh, zsh, CGI Scripts, Cron Jobs

YAML (CI/CD)

GitHub Actions, GitLab CI, Jenkins, Azure Pipelines

Secrets (All File Types)

Configuration files, environment files, documentation, source code, commit history

Compliance Mapping

Every Codepure finding is automatically mapped to the compliance frameworks your organization and auditors care about. The SARIF output includes control IDs and descriptions for each vulnerability.

PCI DSS — Payment Card Industry requirements for injection flaws, cross-site scripting, strong cryptography, and credential management
GDPR — General Data Protection Regulation requirements for personal data protection, encryption in transit, and access controls
HIPAA — Health Insurance Portability and Accountability Act requirements for protected health information, encryption, and audit controls
NCA ECC (Saudi Arabia) — Essential Cybersecurity Controls for input validation, XSS, path traversal, XXE, deserialization, SSRF, and credential management
SAMA (Saudi Arabia) — Cybersecurity Framework for secure coding, access control, XML processing, encryption, and cryptographic algorithms

Using Codepure SAST

Quick Start

1. Initiate Scan

Configure and launch your SAST analysis:

Navigate to your project dashboard
Select the repository or upload code
Choose SAST from the scanner options
Configure scan parameters:
- Select rule sets (OWASP, CWE, Custom)
- Set severity thresholds
- Choose full or targeted scan
Click Start Scanning to begin analysis

2. Review Results

Access detailed vulnerability findings with contextual information:

Each finding includes:

Severity — Critical, High, Medium, Low, Informational
CWE classification — Common Weakness Enumeration mapping
OWASP Top 10 category — alignment with industry standards
Compliance tags — PCI DSS, GDPR, HIPAA, NCA ECC, SAMA relevance
Complete attack trace — source-to-sink chain showing exactly how user input reaches the dangerous operation, with line numbers and code at each step

Filter results by severity, vulnerability type, compliance standard, file, team, or introduction date.

3. Remediate Vulnerabilities

Get actionable fix guidance with code examples:

Each finding includes a detailed description of the vulnerability, a realistic attack scenario showing how it could be exploited, vulnerable code alongside the secure pattern, and specific step-by-step remediation guidance. Re-scan to confirm the fix.

Built-In Capabilities

Secret Detection

34 pattern types scan for hardcoded credentials, API keys, tokens, and private keys across all file types — not just source code. Finds secrets in configuration files, environment files, documentation, and commit history. Runs as part of the standard SAST scan — no separate tool needed. Detects: AWS access keys and secrets, Azure connection strings and tenant IDs, database connection strings and JDBC URLs, Docker passwords, GitHub tokens and OAuth tokens, GitLab tokens, Google Cloud API keys and service accounts, Heroku API keys, JWT secrets, Mailchimp and Mailgun API keys, OpenAI API keys, RSA and SSH private keys, Slack tokens and webhooks, Stripe publishable and secret keys, Twilio API keys and account SIDs, and generic password and secret assignment patterns.

CI/CD Pipeline Scanning

53 patterns check CI/CD configuration files for security misconfigurations in GitHub Actions, GitLab CI, Jenkins, and Azure Pipelines:

Unpinned action versions
Hardcoded credentials in workflow files
Insecure OIDC configurations
Containers running as root
Missing approval gates for production deployments
Untrusted third-party actions
Variables exposed in logs
Insecure artifact uploads
curl | bash and wget | bash patterns
Missing SAST scan steps
World-writable permissions
chmod 777 usage
Dangerous rm -rf patterns
sudo usage in pipelines

SARIF Output

Export findings in OASIS SARIF 2.1.0 format with --format=sarif. The output includes full rule definitions with security severity levels, complete result details with locations, partial fingerprints for deduplication, custom compliance mappings with NCA ECC/SAMA/PCI DSS control IDs, and taint traces showing the complete attack chain. Compatible with GitHub Advanced Security, GitLab SAST, Azure DevOps, and all SARIF consumers.

Inter-Procedural Analysis

Codepure tracks tainted data across file and module boundaries. When user input enters through a controller, flows through a service layer, and reaches a SQL query in a data access object, Codepure connects all three files into a single finding with a complete attack trace.

AST Caching

Parsed abstract syntax trees are cached to avoid redundant re-parsing. When the same file is scanned multiple times — common in CI/CD pipelines — Codepure reuses the cached AST, reducing scan time on repeated and incremental runs.

​For Executives

​What SAST Does

​How Codepure SAST Works

​Vulnerability Categories

​Supported Languages and Frameworks

​JavaScript / TypeScript

​Python

​PHP

​Java

​C# / .NET

​Go

​Ruby

​Kotlin

​Scala

​Groovy

​Swift

​Dart / Flutter

​Rust

​C

​C++

​Solidity

​Salesforce Apex

​SAP ABAP

​COBOL

​Bash / Shell

​YAML (CI/CD)

​Secrets (All File Types)

​Compliance Mapping

​Using Codepure SAST

​Quick Start

​1. Initiate Scan

​2. Review Results

​3. Remediate Vulnerabilities

​Built-In Capabilities

​Secret Detection

​CI/CD Pipeline Scanning

​SARIF Output

​Inter-Procedural Analysis

​AST Caching