sastastic

Ingests Semgrep SAST output (JSON) and creates Jira tickets for each finding. Designed to run in CI on every push — duplicate findings are automatically skipped and tickets for resolved findings are closed.

Requirements

  • Python 3.8+
  • A sast.json file in the working directory (Semgrep JSON output)
  • Jira API credentials set as environment variables (Only if you need to check against existing tickets)

Installation

pip install sastastic

Environment Variables

Variable Description
JIRA_KEY Jira API token
JIRA_URL Jira REST API issue endpoint (e.g. https://your-org.atlassian.net/rest/api/3/issue)
JIRA_EMAIL Email address associated with the API token
JIRA_PROJECT Jira project key (e.g. SEC)

Variables can be set in the environment or in a .env file in the working directory.

Usage

sastastic — Create Jira tickets (CI/CD)

sastastic "app-name" "PARENT-TICKET" [--severity high|med|low|all] [--env <name>] [--allow]
  • app-name — label for the application being scanned (used in ticket summaries)
  • PARENT-TICKET — Jira issue key to attach findings to as subtasks (e.g. SEC-42)

Idempotent by design: each finding is fingerprinted and stored as a Jira label (sastastic-<fingerprint>). On subsequent runs:

  • Findings with an existing open ticket are skipped
  • Tickets whose finding no longer appears in the scan are automatically transitioned to Done (auto-close is based on finding presence, not severity — lowering --severity on a later run will not close tickets for findings that are still detected)

Fails the build by default. sastastic exits with code 1 when it sees any new finding at or above the severity threshold. A finding is new when:

  • no open ticket tracks it yet, or
  • the ticket tracking it is marked as having reached a deployed environment (see --env)

Tickets are still created, and resolved findings are still closed, before exiting. Pass --allow to report new findings without failing.

Flags:

Flag Description
--severity high|med|low|all Only create tickets for findings at or above this severity. Default: high
--env <name> Mark findings as present on a deployed environment (e.g. prod, staging). See below.
--allow Explicitly permit new vulnerabilities — report them but exit 0 instead of 1.

Unknown flags are a hard error, so a typo in --allow can never silently let a build through.

Deployed environments (--env)

--env <name> records that the findings in this scan are live on that environment. Every ticket it touches gets a sastastic-env-<name> label — both newly created tickets and existing open tickets that did not carry the label yet.

Any open ticket carrying a sastastic-env-* label counts as a new finding on every subsequent run, whether or not that run passes --env. A vulnerability that reached staging or production therefore keeps blocking deployments until its ticket is closed in Jira, or the label is removed by hand.

The name is slugified for use as a Jira label (--env "US East / Prod" → sastastic-env-us-east-prod).

sastastic "app-name" "SEC-42" --env prod       # blocks, and marks findings as live on prod
sastastic "app-name" "SEC-42" --env staging    # same, for staging
sastastic "app-name" "SEC-42" --allow          # CI push build: create tickets, never fail

sastestic — Dry-run preview (local development)

Preview what tickets would be created without touching Jira.

sastestic [--windows] [--severity high|med|low|all]

Flags:

Flag Description
--windows Read sast.json as UTF-16 (required on some Windows environments)
--severity high|med|low|all Control which findings are displayed. Default: high

Default output behavior:

By default, sastestic only shows findings that are actionable:

  • When Jira credentials are configured: findings that would generate a new ticket, plus all findings at or above the severity threshold (new or existing)
  • When Jira credentials are not configured: findings at or above the severity threshold only

Use --severity to widen or narrow what is shown. The Total: line always reflects all findings in the scan regardless of the severity filter; the Would create: and Would block: counts below it only count findings at or above the threshold, so they match what sastastic would actually do.

Findings tracked by a ticket already marked with a sastastic-env-* label are shown as [BLOCKING: KEY on prod] and counted toward Would block:.

Example output (--severity all):

Issue 1: [HIGH] CWE-89: SQL Injection
  Rule:    python.django.security.injection.tainted-sql-string
  File:    app/views.py line(s) 42-44
  Details: Detected user input used directly in a SQL query.

Issue 2: [MEDIUM] CWE-79: Cross-Site Scripting
  Rule:    javascript.react.security.audit.react-dangerouslysetinnerhtml
  File:    src/components/Comment.jsx line(s) 17-17
  Details: dangerouslySetInnerHTML usage detected.

Total: 2 findings: 1 HIGH, 1 MEDIUM

Example output (default, with Jira credentials present):

Checking Jira for existing tickets...

Issue 1: [HIGH] CWE-89: SQL Injection  [EXISTS: SEC-101]
  Rule:    python.django.security.injection.tainted-sql-string
  File:    app/views.py line(s) 42-44
  Details: Detected user input used directly in a SQL query.

Issue 2: [MEDIUM] CWE-79: Cross-Site Scripting  [NEW]
  Rule:    javascript.react.security.audit.react-dangerouslysetinnerhtml
  File:    src/components/Comment.jsx line(s) 17-17
  Details: dangerouslySetInnerHTML usage detected.

Total: 2 findings: 1 HIGH, 1 MEDIUM
  Would create: 1 new ticket
  Would block:  1 new finding (exit 1 without --allow)

Generating sast.json

Run Semgrep with JSON output and save to sast.json in your project root:

semgrep --config auto --json -o sast.json .

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Newer release available (2.0.1)

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for Benyonce from gravatar.com Benyonce

Credits

Author: Benyonce

License

GNU GENERAL PUBLIC LICENSE

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

sastastic-2.0.0.tar.gz (48.7 kB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

sastastic-2.0.0-py3-none-any.whl (36.0 kB view details)

Uploaded Python 3

File details

Details for the file sastastic-2.0.0.tar.gz.

File metadata

  • Download URL: sastastic-2.0.0.tar.gz
  • Upload date:
  • Size: 48.7 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? No
  • Uploaded via: twine/6.2.0 CPython/3.12.3

File hashes

Hashes for sastastic-2.0.0.tar.gz
Algorithm Hash digest
SHA256 e12355d486f75342d49cdc8d96f7d6d75a2238b1afd7b99228bdf9d24e4a3064
MD5 2788230f8fbb116d6b63ab659884c59b
BLAKE2b-256 7a3247ae1c777a397f5067e3353a87929626a521ea0b44d505bae210369fde26

See more details on using hashes here.

File details

Details for the file sastastic-2.0.0-py3-none-any.whl.

File metadata

  • Download URL: sastastic-2.0.0-py3-none-any.whl
  • Upload date:
  • Size: 36.0 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? No
  • Uploaded via: twine/6.2.0 CPython/3.12.3

File hashes

Hashes for sastastic-2.0.0-py3-none-any.whl
Algorithm Hash digest
SHA256 b40a5c5229e5650522c316b3c9f1f98d53a0658d44045caf5487dbea9ef5abb6
MD5 a9b091f1dc7ffa9020e8db3104514649
BLAKE2b-256 d32f127b409f6a95a041cc9f1d4458bf5c3eeb280569e9eca97690293dfbb8ab

See more details on using hashes here.

Release history Release notifications | RSS feed

2.0.1

2 files

This release

2.0.0 This release

2 files

1.2.6

2 files

1.2.5

2 files

1.2.4

2 files

1.2.3

2 files

1.2.2

2 files

1.2.1

2 files

1.2.0

2 files

1.1.14

2 files

1.1.13

2 files

1.1.12

2 files

1.1.11

2 files

1.1.10

2 files

1.1.9

2 files

1.1.8

2 files

1.1.7

2 files

1.1.6

2 files

1.1.5

2 files

1.1.4

2 files

1.1.3

2 files

1.1.2

2 files

1.1.1

2 files

1.1.0

2 files

1.0.27

2 files

1.0.26

2 files

1.0.25

2 files

1.0.24

2 files

1.0.23

2 files

1.0.22

2 files

1.0.21

2 files

1.0.20

2 files

1.0.19

2 files

1.0.18

2 files

1.0.17

2 files

1.0.16

2 files

1.0.15

2 files

1.0.14

2 files

1.0.13

2 files

1.0.12

2 files

1.0.11

2 files

1.0.10

2 files

1.0.9

2 files

1.0.8

2 files

1.0.7

2 files

1.0.6

2 files

1.0.5

2 files

1.0.4

2 files

1.0.3

2 files

1.0.2

2 files

1.0.1

2 files

1.0.0

2 files

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Depot Continuous Integration Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page