> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/security-testing-orchestration/use-sto/set-up-sto-scans/static-application-security-testing.md).

# Static Application Security Testing - SAST

Static Application Security Testing (SAST) is a security testing practice that analyzes source code or binaries for potential vulnerabilities without executing the application. It is a crucial process for identifying and addressing security risks early in the software development lifecycle (SDLC).

With Harness Security Testing Orchestration (STO), you can easily perform SAST using a wide range of [integrated scanners](#supported-scanners-for-sast). STO also applies its own features, such as results normalization, the deduplication of findings within each scanner, and formatting results to make them actionable.

### Set up SAST scanning with Harness STO <a href="#set-up-sast-scanning-with-harness-sto" id="set-up-sast-scanning-with-harness-sto"></a>

You can use any of the [integrated scanners](#supported-scanners-for-sast) that perform SAST scanning, or you can leverage the Harness STO [Built-in Scanner workflow](/security-testing-orchestration/use-sto/set-up-sto-scans/built-in-scanners.md). The Built-in Scanner step enables you to set up scans without the need for paid licenses or complex configurations. Currently, the Built-in Scanner uses Semgrep, and adding it via the SAST step automatically integrates [Semgrep](/security-testing-orchestration/use-sto/sto-scanner-configuration/semgrep/semgrep-scanner-reference.md#configure-semgrep-as-a-built-in-scanner) into your pipeline with everything configured. Alternatively, follow the specific integration guides linked below for detailed configuration steps.

{% embed url="<https://youtu.be/qFnS6X4d5Ro?si=2s1oTw2f8q-mzrkx>" %}

#### Supported Scanners for SAST <a href="#supported-scanners-for-sast" id="supported-scanners-for-sast"></a>

Below is the list of supported SAST scanners in Harness STO:

1. [**Harness Code**](/security-testing-orchestration/use-sto/harness-security-scanners/sast.md)
2. [**Bandit**](/security-testing-orchestration/use-sto/sto-scanner-configuration/bandit-scanner-reference.md) - *open-source*
3. [**Black Duck**](/security-testing-orchestration/use-sto/sto-scanner-configuration/black-duck-hub-scanner-reference.md) (by Synopsys)
4. [**Brakeman**](/security-testing-orchestration/use-sto/sto-scanner-configuration/brakeman-scanner-reference.md) - *open-source*
5. [**Checkmarx**](/security-testing-orchestration/use-sto/sto-scanner-configuration/checkmarx/checkmarx-scanner-reference.md)
6. [**Checkmarx One**](/security-testing-orchestration/use-sto/sto-scanner-configuration/checkmarx/checkmarxone-scanner-reference.md)
7. [**Coverity**](/security-testing-orchestration/use-sto/sto-scanner-configuration/coverity-scanner-reference.md) - *open-source*
8. [**CodeQL**](/security-testing-orchestration/use-sto/sto-scanner-configuration/codeql-scanner-reference.md)
9. [**FOSSA**](/security-testing-orchestration/use-sto/sto-scanner-configuration/fossa-scanner-reference.md)
10. [**GitHub Advanced Security**](/security-testing-orchestration/use-sto/sto-scanner-configuration/github-advanced-security.md)
11. [**Mend**](/security-testing-orchestration/use-sto/sto-scanner-configuration/mend-scanner-reference.md) (formerly known as WhiteSource)
12. [**Semgrep**](/security-testing-orchestration/use-sto/sto-scanner-configuration/semgrep/semgrep-scanner-reference.md) - *open-source option*
13. [**Snyk**](/security-testing-orchestration/use-sto/sto-scanner-configuration/snyk/snyk-scanner-reference.md)
14. [**SonarQube**](/security-testing-orchestration/use-sto/sto-scanner-configuration/sonarqube-sonar-scanner-reference.md)
15. [**Veracode**](/security-testing-orchestration/use-sto/sto-scanner-configuration/veracode-scanner-reference.md)
16. [**Wiz**](/security-testing-orchestration/use-sto/sto-scanner-configuration/wiz/repo-scans-with-wiz.md)

If the scanner you use for SAST scanning is not listed, you can explore additional [scanners](/security-testing-orchestration/use-sto/sto-custom-scanning-and-ingestion/custom-scan-reference.md) that are compatible with the [Custom Scan step](/security-testing-orchestration/use-sto/sto-custom-scanning-and-ingestion/custom-scan-reference.md). If the Custom Scan step does not support the scanner you need, you can use the [Custom Ingestion](/security-testing-orchestration/use-sto/sto-custom-scanning-and-ingestion/custom-ingest-reference.md) step to ingest and process your scan results.

### Next steps <a href="#next-steps" id="next-steps"></a>

After running a security scan, you can take the following actions:

* **View Scan Results**: See the security scan results in the pipeline execution. [View scan results](/security-testing-orchestration/use-sto/sto-security-issues/view-scan-results.md).
* **Remediate Issues with AI**: Use AI-based suggestions to fix identified vulnerabilities. [Use AI to fix security issues](/security-testing-orchestration/use-sto/sto-remediate-issues/ai-based-remediations.md).
* **Create Jira Tickets**: Create Jira tickets for detected security issues directly from the UI. [Create Jira Tickets](/security-testing-orchestration/use-sto/jira-integrations.md).
* **Exempt issues**: Manage and exempt specific issues based on requirements. [Exemption workflows](/security-testing-orchestration/use-sto/sto-exempt-issues/exemption-workflows.md)
* **Enforce Policies**: Apply OPA policies for control and governance. [Enforce OPA policies](/security-testing-orchestration/use-sto/enforce-sto-policies-for-governance/enforce-opa-policies.md).