SAST
Find the bug
before it ships.
The agent reads your code for flaws no rule can express. Our 3,676 rules give the same answer on every commit, in CI and offline. It all runs on your server, so your source never leaves it.
SQL query built from request input
payments-service · src/orders/search.py · line 42
40 def search(request):
41 term = request.args.get("q")
42 rows = db.execute(f"SELECT * FROM orders WHERE ref = '{term}'")
43 return jsonify(rows)Rulecerberon.python.sqli.fstring-query
StandardCWE-89
Agent triageConfirmedRequest input reaches the query unbound.
What it does
- Deep analysis by the agentThe agent reads the source tree for flaws no rule can express, such as broken access control, business logic and session handling, and lists which files it examined and which it did not.
- 3,676 Cerberon rulesWritten by our team, and each one proven against a vulnerable example that must trigger it and a safe look-alike that must not.
- 18 languagesJavaScript, TypeScript, Python, Go, Java, Kotlin, C#, C++, PHP, Ruby, Rust, Swift, Scala, Bash, PowerShell, SQL, Lua and Perl.
- Infrastructure as codeDockerfiles, Kubernetes, Helm, Kustomize, Terraform, CloudFormation, Ansible, nginx and CI files.
- Secrets in the same scanKeys, tokens and passwords found in the tree. The matched value is stored redacted, never in clear.
- Agent triageAn AI reviewer reads each finding against the cited code and confirms whether it holds, so your team fixes real issues first. It never changes severity or deletes a finding.
- Honest gapsA language the rules do not cover is named in the limitations. No findings never means clean.
What you get
- Findings with file, line, rule and evidence
- CWE references on every finding
- SARIF for GitHub, GitLab and Azure DevOps
- A CI gate that fails the build on real risk
Mapped to
- OWASP Top 10 2025
- CWE
- SARIF 2.1.0
How it works
- Point it at codeA Git repository on a branch, tag or commit, or an uploaded archive.
- Pick the depthThe agent uses the AI you choose, masked before anything leaves. Without AI, the rules and secret scanning still run and send nothing anywhere.
- Gate the pipelineRun from CI, fail on the quality gate and publish SARIF.
Documentation
Read the details
Setup, every option and the API, on docs.cerberon.dev.
Common questions
Does my source code leave my network?
Not in Scanner mode. Agent triage sends each finding's rule, path, line and snippet, and deep analysis sends the files the agent reads, both masked first.
Is dependency scanning part of SAST?
SAST covers code, secrets and IaC in one scan. SCA runs alongside on the same repository, and both land in the same tracker.
See it on your own systems.
A 30-minute demo on your targets, or install it yourself and start scanning this afternoon.