Enhanced with input — deep scan only17 checks
Deep Source Code Analysis (SAST)
Full static analysis of your connected repository with semgrep — parses each file into a syntax tree and tracks how untrusted input flows through it, catching the multi-function injection, auth and crypto bugs a pattern match structurally cannot see.
How this scan works
- Deep Scan only (Pro/Max) — runs in the background with no per-scanner time limit, because static analysis takes from 20 seconds to several minutes depending on repository size
- Needs a connected GitHub repository
- Parses every source file into a syntax tree and matches semgrep’s curated ruleset against that tree, with dataflow and taint tracking
- This is what the pattern-based Source Code SAST Scanner structurally cannot do: catch untrusted input that reaches a dangerous sink after passing through several functions, rather than only the single-line version of the bug
- Covers injection, authentication, cryptography, deserialization, SSRF, path traversal and hardcoded-credential rules across JavaScript, TypeScript, Python, Go, Ruby, Java, PHP, C# and more
- Findings are filtered to semgrep’s security category — style, correctness and performance rules are counted in the coverage line but never scored
- Each finding carries its rule id, CWE, severity, semgrep’s own confidence rating, and every file and line it matched
- Runs entirely on the scanner host with telemetry disabled — your source is never sent to a third-party analysis service