> ## Documentation Index
> Fetch the complete documentation index at: https://docs.codethreat.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Deterministic SAST

> Rule-based static code analysis enhanced by agentic analysis

Deterministic SAST performs rule-based static analysis of your source code to identify security vulnerabilities using established patterns and security rules. Results are enhanced by **False Positive Elimination** agent and complemented by **Agentic SAST** for deep analysis of complex vulnerabilities.

## How It Works

Deterministic SAST uses pattern matching and rule-based detection:

1. **Pattern matching**: Identifies known vulnerable code patterns
2. **Dataflow analysis**: Tracks untrusted data through code
3. **Control flow analysis**: Identifies unsafe execution paths
4. **Semantic understanding**: Analyzes code structure and meaning

**Powered by**: OpenGrep (enhanced Semgrep fork) + ShiftQL intelligent analysis

**Coverage**: 1,740+ security rules across 27+ languages

***

## What Deterministic SAST Finds

* **Injection flaws**: SQL injection, command injection, code injection
* **Cross-Site Scripting (XSS)**: Reflected, stored, DOM-based
* **Authentication issues**: Broken auth, session management flaws
* **Authorization flaws**: Missing access controls, insecure direct object references
* **Cryptographic issues**: Weak algorithms, insecure random number generation
* **Security misconfigurations**: Debug mode enabled, default credentials
* **Input validation**: Missing or improper validation
* **Path traversal**: Directory traversal vulnerabilities

***

## Language Support

Deterministic SAST supports 27+ languages with comprehensive rule coverage.

**Deep coverage** (100+ rules each):

* Python (334 rules) - Django, Flask, FastAPI
* Terraform (362 rules) - AWS, Azure, GCP, Kubernetes
* JavaScript (173 rules) - React, Vue, Angular, Node.js
* Java (121 rules) - Spring, Jakarta EE
* YAML/Kubernetes (120 rules) - K8s manifests, Helm charts
* Ruby (92 rules) - Rails, Sinatra
* Go (76 rules) - Gin, Echo, standard library
* PHP (61 rules) - Laravel, Symfony, WordPress
* C# (51 rules) - ASP.NET, .NET Core
* Solidity (50 rules) - Smart contracts

**Additional support**: TypeScript, Scala, Kotlin, Swift, Rust, Elixir, OCaml, Bash, C/C++, Apex, Clojure, Dockerfile, HTML, JSON

[View complete SAST support matrix →](/reference/sast-support-matrix)

***

## False Positive Elimination

The False Positive Elimination agent analyzes deterministic SAST results to reduce false positives by understanding code context:

* Validates input sanitization before vulnerable sinks
* Recognizes framework-specific security protections
* Traces dataflow to verify exploitability
* Filters violations that aren't actually exploitable

[Learn more about False Positive Elimination →](/ai/false-positive-elimination)

***

## Agentic SAST

Agentic SAST performs deep code analysis using graph-based analysis to identify logic flaws, authorization issues, and design failures that deterministic SAST cannot detect.

[Learn more about Agentic SAST →](/platform/agentic-sast)

***

Configure deterministic SAST scanning in repository settings:

* Enable/disable SAST scanning
* Select rulesets to apply
* Configure scan paths and exclusions
* Set severity thresholds
* Enable false positive elimination

***

## Next Steps

<CardGroup cols={2}>
  <Card title="SAST Support Matrix" icon="code" href="/reference/sast-support-matrix">
    View complete language coverage
  </Card>

  <Card title="False Positive Elimination" icon="filter" href="/ai/false-positive-elimination">
    Reduce false positives with AI
  </Card>

  <Card title="Agentic SAST" icon="brain-circuit" href="/platform/agentic-sast">
    Deep AI-powered code analysis
  </Card>

  <Card title="Running Scans" icon="play" href="/scanning/running-scans">
    Trigger security scans
  </Card>
</CardGroup>