sastastic

Ingests Semgrep SAST output (JSON) and creates Jira tickets for each finding. Designed to run in CI on every push — duplicate findings are automatically skipped and tickets for resolved findings are closed.

Requirements

Python 3.8+
A sast.json file in the working directory (Semgrep JSON output)
Jira API credentials set as environment variables (Only if you need to check against existing tickets)

Installation

pip install sastastic

Environment Variables

Variable	Description
`JIRA_KEY`	Jira API token
`JIRA_URL`	Jira REST API issue endpoint (e.g. `https://your-org.atlassian.net/rest/api/3/issue`)
`JIRA_EMAIL`	Email address associated with the API token
`JIRA_PROJECT`	Jira project key (e.g. `SEC`)

Variables can be set in the environment or in a .env file in the working directory.

Usage

`sastastic` — Create Jira tickets (CI/CD)

sastastic "app-name" "PARENT-TICKET" [--severity high|med|low|all] [--prod]

app-name — label for the application being scanned (used in ticket summaries)
PARENT-TICKET — Jira issue key to attach findings to as subtasks (e.g. SEC-42)

Idempotent by design: each finding is fingerprinted and stored as a Jira label (sastastic-<fingerprint>). On subsequent runs:

Findings with an existing open ticket are skipped
Tickets whose finding no longer appears in the scan are automatically transitioned to Done (auto-close is based on finding presence, not severity — lowering --severity on a later run will not close tickets for findings that are still detected)

Flags:

Flag	Description
`--severity high\|med\|low\|all`	Only create tickets for findings at or above this severity. Default: `high`
`--prod`	Exit with code 1 to fail the deployment pipeline if any finding (at or above the severity threshold) does not already have an open Jira ticket. Tickets are still created and resolved findings are still closed before exiting.

`sastestic` — Dry-run preview (local development)

Preview what tickets would be created without touching Jira.

sastestic [--windows] [--severity high|med|low|all]

Flags:

Flag	Description
`--windows`	Read `sast.json` as UTF-16 (required on some Windows environments)
`--severity high\|med\|low\|all`	Control which findings are displayed. Default: `high`

Default output behavior:

By default, sastestic only shows findings that are actionable:

When Jira credentials are configured: findings that would generate a new ticket, plus all findings at or above the severity threshold (new or existing)
When Jira credentials are not configured: findings at or above the severity threshold only

Use --severity to widen or narrow what is shown. The summary totals always reflect all findings in the scan regardless of the severity filter.

Example output (--severity all):

Issue 1: [HIGH] CWE-89: SQL Injection
  Rule:    python.django.security.injection.tainted-sql-string
  File:    app/views.py line(s) 42-44
  Details: Detected user input used directly in a SQL query.

Issue 2: [MEDIUM] CWE-79: Cross-Site Scripting
  Rule:    javascript.react.security.audit.react-dangerouslysetinnerhtml
  File:    src/components/Comment.jsx line(s) 17-17
  Details: dangerouslySetInnerHTML usage detected.

Total: 2 findings: 1 HIGH, 1 MEDIUM

Example output (default, with Jira credentials present):

Checking Jira for existing tickets...

Issue 1: [HIGH] CWE-89: SQL Injection  [EXISTS: SEC-101]
  Rule:    python.django.security.injection.tainted-sql-string
  File:    app/views.py line(s) 42-44
  Details: Detected user input used directly in a SQL query.

Issue 2: [MEDIUM] CWE-79: Cross-Site Scripting  [NEW]
  Rule:    javascript.react.security.audit.react-dangerouslysetinnerhtml
  File:    src/components/Comment.jsx line(s) 17-17
  Details: dangerouslySetInnerHTML usage detected.

Total: 2 findings: 1 HIGH, 1 MEDIUM
  Would create: 1 new ticket

Generating `sast.json`

Run Semgrep with JSON output and save to sast.json in your project root:

semgrep --config auto --json -o sast.json .

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

sastastic-1.2.6.tar.gz (45.8 kB view details)

Uploaded Jul 24, 2026 Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

The dropdown lists show the available interpreters, ABIs, and platforms. Enable javascript to be able to filter the list of wheel files.

sastastic-1.2.6-py3-none-any.whl (33.5 kB view details)

Uploaded Jul 24, 2026 Python 3

File details

Details for the file sastastic-1.2.6.tar.gz.

File metadata

Download URL: sastastic-1.2.6.tar.gz
Upload date: Jul 24, 2026
Size: 45.8 kB
Tags: Source
Uploaded using Trusted Publishing? No
Uploaded via: twine/6.2.0 CPython/3.12.3

File hashes

Hashes for sastastic-1.2.6.tar.gz
Algorithm	Hash digest
SHA256	`aaea64c3e4698f2a6be01e811e7e06670c5ff31492083c86d71763210d7211c8`
MD5	`8a4044a045655c811568ec0f8ed7cb83`
BLAKE2b-256	`4bf65e648cae7f558e0869f986999a41d563c645bf727a2ec5951fd388fae992`

See more details on using hashes here.

File details

Details for the file sastastic-1.2.6-py3-none-any.whl.

File metadata

Download URL: sastastic-1.2.6-py3-none-any.whl
Upload date: Jul 24, 2026
Size: 33.5 kB
Tags: Python 3
Uploaded using Trusted Publishing? No
Uploaded via: twine/6.2.0 CPython/3.12.3

File hashes

Hashes for sastastic-1.2.6-py3-none-any.whl
Algorithm	Hash digest
SHA256	`1c3b7275d74031d1e892b9ad59f8874e33a6ebd9fb33627967ae9bdfb26cfdd8`
MD5	`68c9dfee1fde4b45ba4114c7c5f7734d`
BLAKE2b-256	`b51e554d23a329f1dd69836a84ef982435a65b0b14e1cd866687a6acdf39ac7e`