AI-SAST is an AI-driven static application security testing tool. Run it in your repository on your runners—PR scan on pull requests, full scan on demand. Your code never runs on ai-sast infrastructure.

• Vertex AI (Gemini) (default), AWS Bedrock (Claude Opus), or Ollama backends
• PR scan: Scans changed files on pull requests; posts findings as PR comments
• Full scan: Manual run to scan the entire repository
• Your runners: Workflow runs in your repo (e.g. self-hosted); your code stays on your infrastructure
• Multi-language support (Python, JS/TS, Java, Go, Rust, C/C++, and more)
• CVSS scoring, configurable exclusions, optional feedback loop

1. Trigger: Pull request or manual "Run workflow"
2. Scan: Code is analyzed by Vertex AI (Gemini), AWS Bedrock (Claude), or Ollama
3. Validator (if configured): A second LLM (e.g. Bedrock/Claude) validates findings as true or false positive; only validated true positives are posted in the PR.
4. Results: PR comments and HTML/text report artifacts

📖 docs/ARCHITECTURE.md

1. Fork this repository so the workflow uses your fork.

2. Copy the workflow file into the repo you want to scan as .github/workflows/ai-sast.yml:
   .github/workflows/ai-sast.yml

3. Set the repository variable (Settings → Secrets and variables → Actions → Variables):
   AI_SAST_REPO = your fork (e.g. your-username/ai-sast).

4. Add repository secrets (Settings → Secrets and variables → Actions → Secrets):
   GOOGLE_CLOUD_PROJECT, GOOGLE_CREDENTIALS

The workflow checks out your fork at runtime. One file runs PR scan (on pull requests when base branch is main), full scan (manual "Run workflow"), and feedback collection (when someone edits a PR comment and checks a true/false positive box).

Optional: Set AI_SAST_BASE_BRANCH (default main); AI_SAST_REF (default main); runs-on: self-hosted in the workflow for your own runners.

📚 Full guide: docs/INTEGRATION.md

When the PR scan finds issues, it posts a comment like this:

### 🤖 AI-SAST Security Scan
**2** potential issue(s) found.

> 💡 **Help us improve!** Use the checkboxes below to mark each finding as a true positive (✅) or false positive (❌).

| Severity | Count |
|---|---|
| 🔥 High | 2 |

---

<!-- vuln-id: abc12345 -->
- [ ] ✅ True Positive
- [ ] ❌ False Positive

**ID**: `abc12345`
**Severity**: High
**Issue**: SQL Injection vulnerability in user query
**Location**: `src/api/users.py:42`
**CVSS Vector**: `CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N`

<details><summary>📋 Click to see details, risk, and remediation</summary>

**Risk:** Attacker could manipulate SQL queries...

**Validator proof:** User input is concatenated into the query without sanitization; a malicious payload could execute arbitrary SQL.

**Remediation:** Use parameterized queries...

</details>

Developers can mark findings as true positive (✅) or false positive (❌) directly in the PR comment. That feedback is stored in a database (SQLite by default, or Databricks) and included in the prompt sent to Vertex AI on future scans so the model can improve accuracy (e.g. avoid repeating false positives and pay attention to patterns similar to confirmed vulnerabilities).

How it works:

1. PR scan posts a comment with checkboxes next to each finding.
2. Developer checks one box per finding (True Positive or False Positive).
3. collect-feedback workflow runs when the comment is edited and stores feedback in the database.
4. Future scans load that feedback and add it to the Vertex AI (Gemini) prompt as context, so the AI gets more accurate over time.

Feedback collection is included in the same workflow file (see Integrate in your repository). No extra configuration needed for SQLite.

📖 Full guide: docs/FEEDBACK-LOOP.md

All configuration is driven by environment variables. The table below lists supported variables, their description, and default value (if any). Set them as repository Secrets or Variables in GitHub (Settings → Secrets and variables → Actions), or in the workflow env block.

Secrets (e.g. GOOGLE_CREDENTIALS, JIRA_API_TOKEN, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY) have no default and must be set in the repo.

• Auth errors: Service account needs "Vertex AI User" role; GOOGLE_CREDENTIALS must be the full JSON key.
• No PR comment: Ensure the PR targets the branch set by AI_SAST_BASE_BRANCH (default main).
• Feedback not triggering: The feedback job runs from your default branch (e.g. main). Make sure ai-sast.yml is merged to that branch—if it only exists on a feature branch, checking boxes in the PR comment won’t trigger the workflow.
• Setup: Fork this repo, then set repository variable AI_SAST_REPO to your fork (e.g. your-username/ai-sast).

• 🐛 Report bugs
• 💬 Discussions
• 📖 Documentation

Made with ❤️ by the AI-SAST community