SARIF
Static Analysis Results Interchange Format
Static Analysis Results Interchange Format, an OASIS standard (version 2.1.0). A JSON format for static analysis findings, with their locations, rules and fingerprints, which code-scanning platforms such as GitHub ingest from any tool.
- Defined in
- OASIS SARIF Version 2.1.0
Covered in
Combine static and dynamic tests around a verified finding
Use analysis tools to find evidence, then retain an application regression that demonstrates the failure and the fix.
Place each security control in the pipeline and decide what it blocks
Put secrets scanning, SAST, SCA, IaC and image scanning, DAST, fuzzing, attestation and admission control where each sees the right input, block only on findings a developer can act on, and deploy only images the pipeline has attested.
Choose and evaluate application security testing tools
What SAST, DAST, IAST, SCA, secrets, IaC, container and API scanners and ASPM each find and miss, where each runs, how to evaluate them on a seeded repository with per-CWE scoring and triage cost, and which to adopt first.
Practice: Local project: Repair a security pipeline for GitHub Actions and GitLab CI