The ts-sast scanner finds security problems in source code and reports them as SARIF 2.1. It is the static-analysis member of the TrustSource scanner family, next to ts-scan (Software Bill of Materials) and ts-obom (IAM access graph from infrastructure-as-code). The three tools are deliberately separate: a pipeline that only needs an SBOM never has to install a static analyser, and vice versa.
ts-sast starts where the commercial tools stop: with classic Visual Basic 6. Its first backend is Microsoft's DevSkim, extended with a VB6 language definition and a rule pack for the mistakes that VB6 code actually contains: SQL built by string concatenation, Shell with user input, hard-coded credentials, weak CryptoAPI algorithms, TLS validation switched off, dynamic script execution, and more. A semantic VB6 analyser with data-flow analysis is in preparation as a second backend.
ts-sast scan -o findings.sarif path/to/vb6/projectproduces a SARIF log with one run per scanned directory and backend. Each run carries a header in its property bag that mirrors ts-scan's scan header (module, moduleId, source, tag, branch) so that findings can be correlated with the SBOM of the same module.
| Backend | What it does | Languages today |
|---|---|---|
devskim |
Pattern based scan with DevSkim, using the rule packs shipped in ts_sast/rules/devskim on top of DevSkim's own default rules |
Visual Basic 6 (.bas, .cls, .frm, .ctl, .pag, .dsr, .dob, .vbp, .vbg) plus every language DevSkim supports natively |
Pattern matching finds dangerous API usage and obvious mistakes; it does not follow data flow. Use the results to get a quick picture of a legacy code base and to seed a manual review, not as proof of absence.
The recommended way to run ts-sast is the Docker image. The DevSkim backend is a .NET tool, and the image bundles Python, the .NET runtime and a pinned DevSkim, so a scan needs nothing on the host but Docker and behaves identically on every machine and CI runner.
docker pull trustsource/ts-sast
docker run --rm -v "$(pwd)":/workspace trustsource/ts-sast scan -o /workspace/findings.sarif srcPaths are relative to the mounted /workspace. See Operating inside a container for CI gates and configuration.
For a local installation you need Python and the .NET SDK 8 or newer:
pip install ts-sast
dotnet tool install --global Microsoft.CST.DevSkim.CLIIf devskim is not on your PATH, point ts-sast at it with --devskim:executable.
git clone https://github.com/trustsource/ts-sast.git
cd ts-sast
pip install .The command set follows the conventions of ts-scan: verbs as sub-commands, -o/--output and -f/--format for results, --<backend>:<option> for backend specific switches, a profile-based config file and an optional tsproject.toml in the scanned directory.
ts-sast scan -o <path to the output file> [-f <output format>] <path to one or more directories>The -f <output format> option controls the output format and can be:
sarif- SARIF 2.1 JSON (default), consumable by TrustSource, GitHub code scanning, Azure DevOps and most IDEstext- a terminal summary: findings per level, per rule, and the list of findings by file and line
--devskim:executable <PATH>- Path to the DevSkim executable--devskim:forward <ARGS>- Forward parameters to DevSkim, e.g.--devskim:forward --severity,critical,important--devskim:ignore- Do not run the DevSkim backend--rules <DIR>- Additional rule directory, repeatable--fail-on-findings- Exit with code 1 when at least one finding was reported, for CI gates--tag <TAG>,--branch <BRANCH>- Stored in the result header--verbose- Enables verbose mode
The full list of options can be printed using:
ts-sast scan --helpThe repository ships a deliberately insecure VB6 application, examples/vb6-legacy-insecure, that triggers every rule:
ts-sast scan -f text examples/vb6-legacy-insecure/OrderDeskThe VB6 rule pack contains 22 rules, TSVB6001 to TSVB6022, each with embedded must-match / must-not-match self-tests. The rules documentation lists them; devskim verify checks the self-tests, which the CI does on every push.
Like ts-scan, ts-sast reads defaults from a TOML config file with profiles. The default location is ~/.ts-sast/config; it is created on first run:
[default]
format = "sarif"
[ci]
format = "sarif"
fail_on_findings = trueSelect a profile with ts-sast -p ci scan ... and a different file with ts-sast --config <path> scan .... Options can also be set through environment variables prefixed with TS_SAST_, for example TS_SAST_SCAN_OUTPUT_PATH. A tsproject.toml in a scanned directory provides per-project defaults.
ts-sast is licensed under the Apache License 2.0. DevSkim is a separate, MIT licensed tool by Microsoft that ts-sast invokes; it is not bundled in the Python package. rules/devskim/languages.json and comments.json contain DevSkim's default language and comment definitions plus the VB6 additions.