Static code analysis (SAST)

Cerberon’s SAST runs Cerberon’s own rule pack over your code, then two secret scanners. Rule and secret scanning run on your host. Findings carry CWE references.

Start a code scan from New Scan > Code (SAST). The fields are described in Start a scan.

Analysis modes

Mode	API value	What runs	Sent to your AI provider
Scanner	rules-only	Rules and secret scanners	Nothing
Scanner + Agent triage	rules-ai	Rules and secrets, then an AI reviewer assesses each finding against the cited code	Each finding’s rule, path, line and evidence snippet
Scanner + Agent deep analysis	rules-ai-harness	Triage, plus an agent that reads the source tree and reports findings the rules missed	The source the agent reads

Triage is advisory. It never changes a finding’s severity or removes it from the register. Deep analysis records which files it examined and which it did not. Requests to the AI provider are masked when the privacy policy is on.

Coverage

The rule pack has 3,676 rules for JavaScript, TypeScript, Python, Go, Java, Kotlin, C#, C++, PHP, Ruby, Rust, Swift, Scala, Bash, PowerShell, SQL, Lua and Perl.

It also checks Dockerfiles, Kubernetes manifests, Helm, Kustomize, Terraform, CloudFormation, Ansible, nginx, GitHub Actions, GitLab CI and YAML configuration.

A language outside this list is named in the scan’s limitations. No findings for an uncovered language does not mean the code is clean.

Secrets

Secret scanners never store the matched value. A finding keeps the detector, file and line, and the value is stored as «redacted». Cerberon does not test whether a secret is live, so treat every match as exposed and rotate it.

Scan through the API

Upload an archive, then start the scan. The consent block is required for any scan that reads source code, and its mode must allow the analysis mode you request.

# 1. Upload a source archive
UPLOAD_ID=$(curl -sSf -X POST "$CERBERON_URL/api/uploads" \
  -H "Authorization: Bearer $CERBERON_TOKEN" \
  -F "file=@source.tar.gz" | jq -r .artifact.id)

# 2. Start the scan
curl -sSf -X POST "$CERBERON_URL/api/jobs" \
  -H "Authorization: Bearer $CERBERON_TOKEN" \
  -H "Content-Type: application/json" \
  -d '{
    "capability": "sast",
    "target": { "kind": "artifact", "artifactId": "'"$UPLOAD_ID"'" },
    "consent": { "acknowledged": true, "mode": "rules-only" },
    "config": { "sast": { "mode": "rules-only" } }
  }'

To scan a repository instead, use "target": { "kind": "git", "url": "https://git.example.com/team/app.git" }.

Suppress false positives

For a single finding, set its state to False positive in Findings and triage.

To suppress a rule across scans, create sast-suppressions.json and copy it into the Core’s data directory. Each entry records who decided, why and when:

{
  "suppressions": [
    {
      "rule": "cerberon.js.xss.inner-html",
      "path": "src/render/*.js",
      "who": "security-lead",
      "why": "Sanitised by the upstream template layer",
      "at": "2026-10-30T09:00:00Z"
    }
  ]
}

docker cp sast-suppressions.json cerberon-core:/data/sast-suppressions.json

rule is required and path is an optional glob. An entry without who, why and at is rejected. Suppressed findings are kept and counted, and each scan reports how many were suppressed, by which rules, and any entry that matched nothing.