sastastic

Ingests Semgrep SAST output (JSON) and creates Jira tickets for each finding. Designed to run in CI on every push — duplicate findings are automatically skipped and tickets for resolved findings are closed.

Requirements

  • Python 3.8+
  • A sast.json file in the working directory (Semgrep JSON output)
  • Jira API credentials set as environment variables (Only if you need to check against existing tickets)

Installation

pip install sastastic

Environment Variables

Variable Description
JIRA_KEY Jira API token
JIRA_URL Jira REST API issue endpoint (e.g. https://your-org.atlassian.net/rest/api/3/issue)
JIRA_EMAIL Email address associated with the API token
JIRA_PROJECT Jira project key (e.g. SEC)

Variables can be set in the environment or in a .env file in the working directory.

Usage

sastastic — Create Jira tickets (CI/CD)

sastastic "app-name" "PARENT-TICKET" [--severity high|med|low|all] [--env <name>] [--allow]
  • app-name — label for the application being scanned (used in ticket summaries)
  • PARENT-TICKET — Jira issue key to attach findings to as subtasks (e.g. SEC-42)

Idempotent by design: each finding is fingerprinted and stored as a Jira label (sastastic-<fingerprint>). On subsequent runs:

  • Findings with an existing open ticket are skipped
  • Tickets whose finding no longer appears in the scan are automatically transitioned to Done (auto-close is based on finding presence, not severity — lowering --severity on a later run will not close tickets for findings that are still detected)

Fails the build by default. sastastic exits with code 1 when it sees any new finding at or above the severity threshold. A finding is new when:

  • no open ticket tracks it yet, or
  • the ticket tracking it is marked as having reached a deployed environment (see --env)

Tickets are still created, and resolved findings are still closed, before exiting. Pass --allow to report new findings without failing.

Flags:

Flag Description
--severity high|med|low|all Only create tickets for findings at or above this severity. Default: high
--env <name> Mark findings as present on a deployed environment (e.g. prod, staging). See below.
--allow Explicitly permit new vulnerabilities — report them but exit 0 instead of 1.

Unknown flags are a hard error, so a typo in --allow can never silently let a build through.

Deployed environments (--env)

--env <name> records that the findings in this scan are live on that environment. Tickets created by that run get a sastastic-env-<name> label. Tickets that already exist are left untouched — sastastic never goes back and re-labels them.

On a run with --env, every finding counts as new — whether or not a ticket already tracks it — because it is present on a deployed environment right now. On a run without --env, a finding still counts as new if the ticket tracking it carries a sastastic-env-* label from when it was created. A vulnerability first discovered on staging or production therefore keeps blocking deployments until its ticket is closed in Jira, or the label is removed by hand.

The name is slugified for use as a Jira label (--env "US East / Prod" → sastastic-env-us-east-prod).

sastastic "app-name" "SEC-42" --env prod       # blocks, and marks findings as live on prod
sastastic "app-name" "SEC-42" --env staging    # same, for staging
sastastic "app-name" "SEC-42" --allow          # CI push build: create tickets, never fail

sastestic — Dry-run preview (local development)

Preview what tickets would be created without touching Jira.

sastestic [--windows] [--severity high|med|low|all]

Flags:

Flag Description
--windows Read sast.json as UTF-16 (required on some Windows environments)
--severity high|med|low|all Control which findings are displayed. Default: high

Default output behavior:

By default, sastestic only shows findings that are actionable:

  • When Jira credentials are configured: findings that would generate a new ticket, plus all findings at or above the severity threshold (new or existing)
  • When Jira credentials are not configured: findings at or above the severity threshold only

Use --severity to widen or narrow what is shown. The Total: line always reflects all findings in the scan regardless of the severity filter; the Would create: and Would block: counts below it only count findings at or above the threshold, so they match what sastastic would actually do.

Findings tracked by a ticket already marked with a sastastic-env-* label are shown as [BLOCKING: KEY on prod] and counted toward Would block:.

Example output (--severity all):

Issue 1: [HIGH] CWE-89: SQL Injection
  Rule:    python.django.security.injection.tainted-sql-string
  File:    app/views.py line(s) 42-44
  Details: Detected user input used directly in a SQL query.

Issue 2: [MEDIUM] CWE-79: Cross-Site Scripting
  Rule:    javascript.react.security.audit.react-dangerouslysetinnerhtml
  File:    src/components/Comment.jsx line(s) 17-17
  Details: dangerouslySetInnerHTML usage detected.

Total: 2 findings: 1 HIGH, 1 MEDIUM

Example output (default, with Jira credentials present):

Checking Jira for existing tickets...

Issue 1: [HIGH] CWE-89: SQL Injection  [EXISTS: SEC-101]
  Rule:    python.django.security.injection.tainted-sql-string
  File:    app/views.py line(s) 42-44
  Details: Detected user input used directly in a SQL query.

Issue 2: [MEDIUM] CWE-79: Cross-Site Scripting  [NEW]
  Rule:    javascript.react.security.audit.react-dangerouslysetinnerhtml
  File:    src/components/Comment.jsx line(s) 17-17
  Details: dangerouslySetInnerHTML usage detected.

Total: 2 findings: 1 HIGH, 1 MEDIUM
  Would create: 1 new ticket
  Would block:  1 new finding (exit 1 without --allow)

Generating sast.json

Run Semgrep with JSON output and save to sast.json in your project root:

semgrep --config auto --json -o sast.json .

Key dates

PyPI data
Data sourced directly from PyPI's database.
  • Released:
Latest release

1 maintainer

PyPI data
Data sourced directly from PyPI's database.
Avatar for Benyonce from gravatar.com Benyonce

Credits

Author: Benyonce

License

GNU GENERAL PUBLIC LICENSE

Report project as malware

Download files

Download the file for your platform. If you're not sure which to choose, learn more about installing packages.

Source Distribution

sastastic-2.0.1.tar.gz (48.7 kB view details)

Uploaded Source

Built Distribution

If you're not sure about the file name format, learn more about wheel file names.

sastastic-2.0.1-py3-none-any.whl (35.9 kB view details)

Uploaded Python 3

File details

Details for the file sastastic-2.0.1.tar.gz.

File metadata

  • Download URL: sastastic-2.0.1.tar.gz
  • Upload date:
  • Size: 48.7 kB
  • Tags: Source
  • Uploaded using Trusted Publishing? No
  • Uploaded via: twine/6.2.0 CPython/3.12.3

File hashes

Hashes for sastastic-2.0.1.tar.gz
Algorithm Hash digest
SHA256 3b2937b821f10b5d75cc5c95727be7b2d7bd72e4f2ff2d864632b05a25038ab2
MD5 aa96cdab5a026bc6654c6b906c26c94f
BLAKE2b-256 d81bb66cbf2c0836b97a2b344296389967430f62c3a69dded182b2349e5e313b

See more details on using hashes here.

File details

Details for the file sastastic-2.0.1-py3-none-any.whl.

File metadata

  • Download URL: sastastic-2.0.1-py3-none-any.whl
  • Upload date:
  • Size: 35.9 kB
  • Tags: Python 3
  • Uploaded using Trusted Publishing? No
  • Uploaded via: twine/6.2.0 CPython/3.12.3

File hashes

Hashes for sastastic-2.0.1-py3-none-any.whl
Algorithm Hash digest
SHA256 d97a3c7f030782762005ad1d7a153e5c498e25e1cf624e2e40509a617337c124
MD5 fad8c597471de3fc3bd657076f17350d
BLAKE2b-256 3fd73ab2e92d23cafd46fdf06ca9f27a69c023a8b48d5da0aa6cedb139916a9c

See more details on using hashes here.

Release history Release notifications | RSS feed

This release

2.0.1 This release

2 files

2.0.0

2 files

1.2.6

2 files

1.2.5

2 files

1.2.4

2 files

1.2.3

2 files

1.2.2

2 files

1.2.1

2 files

1.2.0

2 files

1.1.14

2 files

1.1.13

2 files

1.1.12

2 files

1.1.11

2 files

1.1.10

2 files

1.1.9

2 files

1.1.8

2 files

1.1.7

2 files

1.1.6

2 files

1.1.5

2 files

1.1.4

2 files

1.1.3

2 files

1.1.2

2 files

1.1.1

2 files

1.1.0

2 files

1.0.27

2 files

1.0.26

2 files

1.0.25

2 files

1.0.24

2 files

1.0.23

2 files

1.0.22

2 files

1.0.21

2 files

1.0.20

2 files

1.0.19

2 files

1.0.18

2 files

1.0.17

2 files

1.0.16

2 files

1.0.15

2 files

1.0.14

2 files

1.0.13

2 files

1.0.12

2 files

1.0.11

2 files

1.0.10

2 files

1.0.9

2 files

1.0.8

2 files

1.0.7

2 files

1.0.6

2 files

1.0.5

2 files

1.0.4

2 files

1.0.3

2 files

1.0.2

2 files

1.0.1

2 files

1.0.0

2 files

Supported by

AWS Cloud computing and Security Sponsor Datadog Monitoring Depot Continuous Integration Fastly CDN Google Download Analytics Sentry Error logging StatusPage Status page