Documentation / Application Security

SAST & SCA

SAST & SCA (App Code Analysis)

Prancer combines Static Application Security Testing (SAST), Secrets scanning and Software Composition Analysis (SCA) in a single App Code Analysis pass. SAST inspects your source code for vulnerable patterns; SCA inspects your third-party dependencies for known CVEs and license risk; the secrets scanner flags credentials accidentally committed to the repo.

Before you start

  • A PAC file created via the PAC Wizard.
  • A Git connector pointing at the branch you want to scan.
  • Optional: a Prancer API token if you plan to run the standalone PCA Docker CLI (create one).

Step 1 — Enable App Code Analysis in your PAC file

Add an AppCodeAnalysis block to the PAC YAML:

AppCodeAnalysis:
  SASTScan: true
  SecretsScan: true
  SCAScan: true
  Remote: true
  Rule: python
  IncrementalScan: true
  GitConnector: git_sca_VulnerableApp

| Field | Purpose |

| --- | --- |

| SASTScan | Static analysis of source code for vulnerable patterns. |

| SecretsScan | Detects secrets/credentials committed to the repo. |

| SCAScan | Software Composition Analysis — checks third-party libraries. |

| IncrementalScan | Only re-tests code that changed since the previous scan. |

| Remote | Pull source code from Git rather than a local path. |

| Rule | Language-specific rule pack (see CLI section for valid values). |

| GitConnector | Name of the Git connector to clone from. |

Set any of SASTScan, SecretsScan, SCAScan to false to disable that scan.

Step 2 — Configure the Git connector

Point the Git connector at the branch you want to scan:

{
  "branchName": "master",
  "companyName": "prancer",
  "fileType": "structure",
  "gitProvider": "https://github.com/SasanLabs/VulnerableApp.git",
  "httpsAccessToken": "Token",
  "private": true,
  "type": "filesystem"
}

See Git connector wizard for the full procedure.

Step 3 — Run the pentest

Trigger the PAC pentest from Inventory Management. Findings appear in App Findings alongside any DAST results from the same run.

Full PAC example

Collection: azure_pac
AppCodeAnalysis:
  SASTScan: true
  SecretsScan: true
  SCAScan: true
  Remote: true
  Rule: python
  IncrementalScan: true
  GitConnector: git_sca_inspector
ConnectionName: azure_pac_connector
CloudType: azure
ApplicationName: azure sca py inspector
RiskLevel: standard
RiskProfit: Medium
Compliance:
- CIS
- CSA-CCM
ApplicationType: WebScan
Schedule: onetime
Target: https://ctflearn.com
Tags:
  Cloud: azure
WebScan:
  AjaxSpider: false
Scanner:
  Cloud:
    Platform:
      Azure:
        ContainerInstance:
          AfterRun: delete
          NewContainerInstance:
            External:
              SubscriptionId: a6941677-4c37-42fb-960c-dad8f25060a3
              ResourceGp: shahin-test
              Region: westus
              ContainerGroupName: prancer-scanner-group
              ContainerName: prancer-pentest-instance
              ResourceName: prancer-instances-inspector
AuthenticationMethod: noAuthentication
AddOns:
# All add-on IDs are listed at https://www.zaproxy.org/addons.

Run App Code Analysis from the CLI

For CI/CD integrations, use the standalone prancer/prancer-pca container.

1. Pull the latest image

docker pull prancer/prancer-pca:latest

2. Configure environment variables

Create docker.env:

| Variable | Description |

| --- | --- |

| CUSTOMER | Your tenant URL prefix, e.g. prancer-acme. |

| ACCESSTOKEN | API token from the Prancer portal. |

| ENVIRONMENT | Deployment env: dev, qa, prod (default prod). |

| CONFIGID | PAC configuration ID from Inventory Management. |

| DIRPATH | Local path to source code (use this or GITURL). |

| RULE | Rule pack to apply (see list below). |

| GITURL | Git repository URL (alternative to DIRPATH). |

| BRANCHNAME | Branch to clone. |

| GITSECRET | Token used to clone the repo. |

| SAST | Enable SAST (default true). |

| SECRETS | Enable secrets scan (default true). |

| SCA | Enable SCA (default true). |

Provide either DIRPATH or the Git triplet (GITURL, BRANCHNAME, GITSECRET).

Valid RULE values: apex, bash, c, clojure, contrib, csharp, dockerfile, elixir, fingerprints, generic, go, html, java, javascript, json, kotlin, ocaml, php, problem-based-packs, python, ruby, rust, scala, solidity, swift, terraform, typescript, yaml.

3a. Scan a local directory

# docker.env
CUSTOMER=prancer-companyname
ACCESSTOKEN=5cd5a27e4f1c4f7f9a3587dr5a70eac0
ENVIRONMENT=prod
CONFIGID=652d44a8ef58f22d23b6cee3
RULE=python
SAST=true
SECRETS=true
SCA=true
DIRPATH=/path/to/repo
# Daemon
docker run -d --rm --name prancer-pca \
  -v /path/to/repo:/path/to/repo \
  --env-file docker.env prancer/prancer-pca:latest

docker logs -f prancer-pca

# Foreground
docker run --rm --name prancer-pca \
  -v /path/to/repo:/path/to/repo \
  --env-file docker.env prancer/prancer-pca:latest

3b. Scan an internal Git repository

# docker.env
CUSTOMER=prancer-companyname
ACCESSTOKEN=5cd5a27e4f1c4f7f9a3587dr5a70eac0
ENVIRONMENT=prod
CONFIGID=652d44a8ef58f22d23b6cee3
RULE=python
GITURL=http://192.168.2.1:9000/organization/repository-name.git
BRANCHNAME=main
GITSECRET=ghp_RpMyae0********************
SAST=true
SCA=true
SECRETS=true
docker run -d --rm --name prancer-pca --env-file docker.env prancer/prancer-pca:latest
docker logs -f prancer-pca

Exit codes

| Code | Meaning |

| --- | --- |

| 0 | Run succeeded, no findings. |

| 1 | Run succeeded, findings produced. |

| 2 | Error (invalid token, no scan type chosen, etc.). |

Tip: Use exit codes to fail your CI pipeline on 1 (findings) and surface logs on 2 (errors).

Next steps