SAST
Static Application Security Testing in runtz.
SAST
SAST (Static Application Security Testing) scans source files locally with a set of high-signal static rules and sends normalized findings to the runtz backend. Your source code never leaves the machine — only the findings do.
Supported languages
| Language | File extensions |
|---|---|
| JavaScript / TypeScript | .js, .jsx, .mjs, .cjs, .ts, .tsx |
| Python | .py |
| Go | .go |
| Java / Kotlin | .java, .kt, .kts |
| Ruby | .rb |
| PHP | .php |
| Rust | .rs |
| C# / .NET | .cs |
Generated and dependency directories such as .git, node_modules, dist,
build, vendor and .next are skipped automatically.
Rules
The initial rules detect:
- Committed private keys and cloud credentials.
- Hardcoded secrets assigned to credential-like variables.
- Dynamic code execution such as
eval. - Shell execution patterns prone to command injection.
- Disabled TLS certificate verification.
- Weak hash functions such as MD5 and SHA-1.
Usage
runtz sast (REPO_PATH | FILE_PATH) [flags]Scan a whole repository:
runtz sast ./ \
--endpoint https://engine.runtz.dev \
--token rtz_live_...Scan a specific directory or file:
runtz sast ./services/payments \
--project payments-api \
--endpoint https://engine.runtz.dev \
--token rtz_live_...Flags
| Flag | Description | Default |
|---|---|---|
--project | Project name shown in the platform | scanned directory name |
--source | Source path, repository or URL | scan path |
--endpoint | Runtz backend endpoint | required |
--token | Token generated in the platform | required |
Stored result
The backend stores the project, source, files scanned, findings, severity summary and timestamp. The token generated in the platform identifies the workspace automatically.