Run SAST scans from the CLI

AlertaVuln’s static analysis (SAST) runs a series of scanners over your source code - looking for injection flaws, hardcoded secrets, insecure configuration, and risky code patterns - normalises everything into one finding set, and tiers each finding RED / YELLOW / GREEN. It runs entirely from the av CLI, so you can scan on your own machine in seconds and wire the same command into CI.

The whole workflow is one command:

av sast scan --path .

Your source never leaves the machine: the scan series is downloaded (pinned and checksum-verified) on first use and runs locally as separate processes. Only if you pass --project are the resulting findings uploaded - never your code.

Run your first scan

You don’t need an account or a login to scan locally. From your repo root:

av sast scan --path .

The first run fetches the scan series, then prints a tiered summary:

What a run prints

$ av sast scan --path .
Scanning . (git: acme/api @ main)
SEVERITY  COUNT
RED       1
YELLOW    6
GREEN     23
RED     server/auth.js:42   Hardcoded credential
YELLOW  api/query.go:88     SQL string concatenation
Run with --project <id> to upload these findings.

Add --format json for machine-readable output you can pipe into jq or attach to a build artifact.

Send findings to a project

To see findings on a project’s Code Scan page and track them over time, pass --project. That uploads the findings - plus the repo URL and git ref detected from the working tree as provenance - so the CLI needs to be authenticated.

Local (interactive)

Sign in once and the CLI remembers you:

av login
av sast scan --path . --project <projectId>

CI / headless

There is no browser login in a pipeline. Put an organisation API key in the ALERTAVULN_API_KEY environment variable; the CLI uses it as the request token for that one invocation and never writes it to disk:

ALERTAVULN_API_KEY=av_live_... av sast scan --path . --project <projectId>

--no-upload keeps a scan local-only even when --project is set - handy for a quick check that never touches the server. The scanned repo and ref are auto-detected from git; override them with --repo and --ref if you scan a checkout whose origin differs from what you want recorded.

Note

ALERTAVULN_API_KEY takes precedence over any saved login and is never persisted, so the same command behaves identically on an ephemeral runner and on your own machine.

Before you start (uploads only)

1. Create an organisation API key with ReadWrite scope. In the web app, open Settings and the API Keys panel (org-admin only). Uploading writes to the project, so the key must be ReadWrite, not ReadOnly. It looks like av_live_ followed by 64 hex characters and is shown once - copy it immediately.

2. Find the project ID. Run av project list and copy the ID from the first column (it is also on the project’s page in the web app).

3. (CI) Store the key as a secret in your CI platform, and the project ID as a plain variable. Never commit either or print the key in logs.

Gate a pull request or build

--fail-on makes the command exit non-zero when the worst finding is at or above a tier, so a newly introduced issue can block a merge:

av sast scan --path . --fail-on red

--fail-on	The command exits non-zero when the worst finding is
red	RED
yellow	YELLOW or RED
none (default)	never - report-only

Add it to CI

The job installs the CLI and scans the checked-out code. Uploading with --project needs the API key; drop --project (or add --no-upload) for a report-only gate that uploads nothing.

GitHub Actions

.github/workflows/alertavuln-sast.yml

name: SAST scan
on:
  pull_request:
  push:
    branches: [main]

jobs:
  sast:
    runs-on: ubuntu-latest
    env:
      # Injected from the repository/organisation secret; read by the CLI.
      ALERTAVULN_API_KEY: ${{ secrets.ALERTAVULN_API_KEY }}
    steps:
      - uses: actions/checkout@v4

      - name: Install the AlertaVuln CLI
        run: |
          curl -fsSL https://get.alertavuln.com/cli/install.sh | sh
          echo "$HOME/.local/bin" >> "$GITHUB_PATH"

      - name: Scan the code
        run: av sast scan --path . --project "${{ vars.ALERTAVULN_PROJECT_ID }}" --fail-on red

Azure DevOps

azure-pipelines.yml

trigger:
  branches:
    include: [main]

pool:
  vmImage: ubuntu-latest

steps:
  - checkout: self

  - script: |
      curl -fsSL https://get.alertavuln.com/cli/install.sh | sh
      echo "##vso[task.prependpath]$HOME/.local/bin"
    displayName: Install the AlertaVuln CLI

  - script: av sast scan --path . --project "$(ALERTAVULN_PROJECT_ID)" --fail-on red
    displayName: SAST scan
    env:
      # Secret variables are NOT auto-exposed to the environment - map it here.
      ALERTAVULN_API_KEY: $(ALERTAVULN_API_KEY)

Caution

Azure DevOps does not expose secret variables to a script’s environment automatically. Map the secret into the step’s env: block explicitly (shown above), or the CLI reports not logged in.

On the next run the job installs the CLI, authenticates with the injected key, scans, and fails the build if the worst finding is RED.

Verify it worked

Pull the consolidated findings the server holds for the project, from the pipeline or your machine:

av sast findings

$ av sast findings --project "$ALERTAVULN_PROJECT_ID" --severity red
SEVERITY  STATE  RULE                     FILE                LINE
RED       Open   hardcoded-credential     server/auth.js      42

The same findings appear on the project’s Code Scan page, and any new or reopened RED / YELLOW finding raises an alert through whatever notification channels you have configured.

Keep the key safe

• Use a dedicated ReadWrite key for CI, separate from any personal login, so you can rotate or revoke it without disrupting anyone else.
• Keep it in your platform’s secret store. Do not echo it, and prefer a Key Vault-backed variable group on Azure DevOps.
• If a key is exposed, revoke it in Settings -> API Keys and issue a new one.

See also

• av sast scan reference - every flag, exit codes, and provenance detail.
• av sast findings - pull a project’s consolidated findings.
• av sast server-scan - scan a project’s connected repos on AlertaVuln’s infrastructure (Enterprise).
• Static analysis (SAST) - what code scanning covers.
• Authentication - interactive login for local use.