SAST

Catch hardcoded secrets & code vulnerabilities before they leave your laptop.
Inline highlights as you type · one-click fixes · a git push gate that blocks leaks — the same engine in VS Code, JetBrains, Visual Studio, and your CI pipeline, so there's zero rule drift between your machine and the build.

Get it for your editor

Plugin home  ·  SDLC pipeline  ·  SAST engine  ·  CLI on PyPI  ·  Manifest

See it in action

Watch the SDLC overview video  ·  Read the full SDLC walkthrough →

Install

For your IDE

On first scan the IDE plugin auto-downloads the matching sast engine for your OS and verifies its SHA-256 — no account, no API key, no telemetry. One engine, identical results in every editor and in CI.

For the terminal & CI/CD (same engine)

Debian / Ubuntu — signed apt repo

curl -sSL https://insom.ai/apt/public-key.asc | sudo gpg --yes --dearmor \
  -o /usr/share/keyrings/insomnia-archive-keyring.gpg
echo "deb [signed-by=/usr/share/keyrings/insomnia-archive-keyring.gpg] https://insom.ai/apt stable main" \
  | sudo tee /etc/apt/sources.list.d/insomnia.list
sudo apt-get update && sudo apt-get install -y sast

Single-binary download (Fedora / Arch / Alpine / air-gapped)

curl -sSL https://insom.ai/latest/sast/linux -o /usr/local/bin/sast   # or .../macos
chmod +x /usr/local/bin/sast
sast --version

Then run a scan anywhere — or drop it into any CI pipeline (SDLC guide →):

sast . --fail-on high --format html,json,sarif --report

Scan a remote repo directly (GitHub / GitLab)

Point sast at a repository URL and it shallow-clones it to a temp dir, scans it, and cleans up — no manual git clone needed. Works with or without a token: public repos need none, private repos take --git-token or a $GITHUB_TOKEN / $GITLAB_TOKEN environment variable.

# Public repo — no auth
sast https://github.com/owner/repo
sast https://gitlab.com/owner/repo --branch develop --fail-on high

# Private repo — token via flag …
sast https://github.com/owner/private-repo --git-token "$TOKEN"
# … or via environment variable
GITHUB_TOKEN=xxxx sast https://github.com/owner/private-repo
GITLAB_TOKEN=xxxx sast https://gitlab.com/owner/private-repo

What it does

• “Vulnerabilities” sidebar + “All Issues” dashboard — a dedicated activity-bar panel plus a rich dashboard with severity counts, filter chips, search, and group-by (file / severity / rule).
• Live guarding as you work — opening a file instantly highlights risky lines and hardcoded secrets: squiggles, a line highlight, scrollbar markers, and an inline hint above each flagged line (HIGH: SQL Injection — use parameterized queries) you can click for CWE + the fix.
• Scan anything — a Scan… dropdown picks the scope: current file, open tabs, a folder, the whole project, or changed files (git). Folders also get a right-click Scan This Folder.
• Push protection — one command installs a .git/hooks/pre-push hook that aborts the push (exit 1) when anything at or above your failOn severity is found — even for terminal pushes. Bypass once with git push --no-verify.
• Mark false positives — dismiss from the tree, the editor lightbulb, or the dashboard; it won’t return on re-scan, and you can restore anytime.
• Speaks your language — the entire UI is localized into 9 languages (English, Русский, 简体中文, Українська, Türkçe, Қазақша, Español, Deutsch, Français), following your VS Code display language.

One engine, everything covered

Multi-language SAST + taint (16 languages), secrets with live key validation, dependency/SCA CVEs, container & OS-package CVEs, IaC misconfig, CMS advisories, and web-shell detection — exported as SARIF / JSON / HTML. See the full coverage & comparison →

Commands (Ctrl/Cmd+Shift+P)

Settings

Two independent axes — what to look for (Mode) and which files to cover (Scope) — and the interactive scan and the push gate each have their own, so you can run a quick secrets-only scan while you work but force a full repo scan before every push.

Want to stop continuous scanning? Flip scanOnOpen/scanOnSave off, or click Pause Auto-Scan (sidebar / status bar) to disable all of it at once. After changing pushScanMode / pushScanScope / failOn, re-run Enable Push Protection to regenerate the hook.

How the scanner is located

1. insomniaSast.binaryPath if set
2. dist_sast/sast(.exe) in the workspace
3. A previously auto-downloaded copy (extension global storage)
4. python sast_cli.py (workspace root or cliScriptPath)
5. Auto-download the OS-matched build from insom.ai (SHA-256 verified)
6. sast / insomnia-sast on PATH

One engine — pick your entry point

insom.ai/en/plugin  ·  insom.ai/en/sdlc  ·  pip install sast
_{Free core · same engine as the Insomnia CI pipeline · SHA-256 published in the manifest · no telemetry}