Static analysis (SAST): Semgrep and Bandit
You set up tools that find security flaws without running the code, interpret findings, weed out false alarms and fit scanning into the developer’s daily flow.
Level 201 · 18 lessons · 15 practice labs
Lessons
Getting to know static analysis
- What SAST is, what it finds and what it misses
- How it works: pattern matching, data flow, syntax trees
- False positives and false negatives
- Short task: compare two tools’ findings on the same code
Semgrep
- A first scan with Semgrep and ready-made rulesets
- Reading findings: rule, location, severity
- Suppressing a finding with a reason: nosemgrep and .semgrepignore
- Only new findings: baseline and diff scans
- Short task: triage a project’s Semgrep findings
Language-specific tools
- Bandit for Python
- ESLint security plugins for JavaScript
- gosec for Go
- A common output format: SARIF
- Short task: fix Bandit’s high-severity findings
Fitting into the workflow
- Scanning before commit with pre-commit
- Instant warnings in the editor
- A SAST job in CI and pull request comments
- Capstone: set up end-to-end static analysis for a web project
Practice labs
- Separate the flaws SAST can find from those it cannot: Mark ten flaw examples as found or not found by static analysis and give a one-word reason.
- Compare two tools’ findings on the same code: Put Semgrep and Bandit output side by side and list the flaws only one tool found and those both found.
- Demonstrate a false positive and a false negative in sample code: Find a line the tool flags that is harmless and a real flaw it misses, and explain both by the analysis technique used.
- Read a finding’s rule, location and severity: Write the rule ID, file and severity for three findings in the scan output.
- Triage a project’s Semgrep findings: Sort twenty findings into fix, suppress with reason or false alarm, and mark the suppressions with a nosemgrep comment.
- Set up a baseline so only new findings show: Record existing findings as the baseline, configure diff scanning and show a newly added flaw is caught while old ones stay quiet.
- Run Bandit on a Python project: Run the scan and list the test IDs of the high-severity findings.
- Fix Bandit’s high-severity findings: Fix the shell call, weak hash and hardcoded password findings and show the scan comes out clean.
- Merge the output of tools for three languages in SARIF: Produce Bandit, ESLint security plugin and gosec results as SARIF, merge them into one file and derive the severity distribution.
- Add a scan before commit with pre-commit: Configure the Semgrep hook and show a flawed change cannot be committed.
- Add a SAST job to CI and comment on the pull request: Add a scan job to the pipeline file and verify findings appear as comments on the pull request.
- Design a scanning set-up that does not slow developers down: Put fast rules before commit and the full scan in CI, measure the timings and justify which rule runs where.
- Choose suitable rulesets for a web project: Pick three stock rulesets by looking at the project’s languages and framework and say why.
- Run and report the first full scan of a web project: Scan the project with your chosen rulesets and summarise findings by severity and type.
- Set up end-to-end static analysis for a web project: Configure editor, pre-commit and CI stages, record the baseline and show a new flaw is caught at all three.
About this course
You set up tools that find security flaws without running the code, interpret findings, weed out false alarms and fit scanning into the developer’s daily flow.
What you will learn
- Getting to know static analysis
- Semgrep
- Language-specific tools
- Fitting into the workflow
Prerequisites
Finishing the level 101 courses of the same path, or knowing those topics, is enough.
Lab environment
Lessons run in your own Kali Linux terminal that opens in the browser. Nothing to install; the lab starts clean in every lesson.
Frequently asked questions
- Is this course right for my level?
- The course is at level 201; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.