Inside the developer workflow
Findings arrive where code is reviewed, while the change is still fresh.
- Scans on pull requests and in CI
- Findings inline in the review
- Fix guidance with every finding
HashGo ยท Static application security testing
HashGo SAST
In development
Find flaws in code before it ships.
HashGo SAST reads your source code without running it, follows data from input to where it is used, and points to the exact line that needs to change.
In development. This page describes what we are building. Features may change before release.
Capabilities
What SAST will do.
Source analysis on every pull request, with data-flow checks and fix guidance at the exact line.
Signal over noise
Fewer alerts, each one worth reading.
- Data-flow analysis to confirm a path is reachable
- Priority based on risk, not only pattern matches
- Duplicate findings grouped
Rules you control
Start with built-in coverage, then teach it your own patterns.
- Built-in rules for each language
- Custom rules for your codebase
- Policies that decide what blocks a build
How it works
Four steps, start to finish.
Connect a repository
Link your source control and choose the branches to scan.
Scan every change
Each pull request is checked before it merges.
Prioritise
Reachable, high-risk findings rise to the top.
Fix and verify
Apply the guidance and confirm the finding is closed.
Coverage
What it covers.
- Java
- Python
- JavaScript
- TypeScript
- Go
- C#
- PHP
- GitHub
- GitLab
- Bitbucket
- Azure DevOps
SAST and DAST
Two views of the same risk.
HashGo SAST reads the code. HashGo DAST tests what is deployed. Most teams need both.
| HashGo SAST | HashGo DAST | |
|---|---|---|
| What it examines | Source code, without running it | The running application, from the outside |
| When it runs | On pull requests and in CI | Against staging or production |
| Typical findings | Injection, unsafe input handling, hardcoded secrets | Auth and session flaws, runtime injection, misconfiguration |
| Needs a deployed app | No | Yes |
What is SAST?
Static application security testing examines source code without executing it, looking for flaws such as injection, unsafe handling of input and hardcoded secrets.
What kinds of issues will it find?
SQL injection, cross-site scripting, hardcoded credentials, insecure deserialisation, weak cryptography and broken authentication logic, among others.
Where does it fit in CI/CD?
On every pull request for fast feedback, and in the pipeline for a full scan. Policies decide which findings fail a build and which are tracked.
How is SAST different from DAST?
SAST reads the code before it runs. DAST tests the running application from the outside. Together they cover what each misses alone.
When will it be available?
It is in development. Write to us for early access.
Be first to try SAST.
Tell us about your environment and we will reach out when early access opens.
