Skip to content

Usage

ts-sast follows the command conventions of ts-scan: verbs as sub-commands, -o/--output and -f/--format for results, --<backend>:<option> for backend specific switches, a profile based config file and an optional tsproject.toml in the scanned directory.

Scan

The scan command runs every enabled backend over one or more directories and assembles the findings into one SARIF log.

ts-sast scan -o <path to the output file> [-f <output format>] <path to one or more directories>

Every directory and backend produces one SARIF run. A file argument is treated as its parent directory.

The -f <output format> option controls the output format and can be:

  • sarif - SARIF 2.1 JSON (default), see Result format
  • text - a terminal summary: findings per level, per rule, and the list of findings by file and line

Without -o the result is printed to standard output.

Backend options

Backend specific options are prefixed with the backend name, like package manager options in ts-scan:

  • --devskim:executable <PATH> - Path to the DevSkim executable (default: devskim on the PATH)
  • --devskim:forward <ARGS> - Forward parameters to DevSkim, comma separated, for example --devskim:forward --severity,critical,important or --devskim:forward --ignore-globs,**/vendor/**
  • --devskim:ignore - Do not run the DevSkim backend

General options

  • --rules <DIR> - Additional rule directory passed to the backends, repeatable. DevSkim loads every JSON file in it as rules
  • --fail-on-findings - Exit with code 1 when at least one finding was reported. Combine with --devskim:forward --severity,critical,important to gate on serious findings only
  • --tag <TAG> - Stores the SCM tag <TAG> in the result header
  • --branch <BRANCH> - Stores the SCM branch <BRANCH> in the result header
  • --verbose - Enables verbose mode, including the backend's own output

The full list of options can be printed using:

ts-sast scan --help

Suppressing a finding

DevSkim honours suppression comments in the scanned source. In VB6 a line comment suffices:

Shell "hh.exe OrderDesk.chm", vbNormalFocus ' DevSkim: ignore TSVB6002

Suppress a rule for a whole scan with --devskim:forward --ignore-rule-ids,TSVB6011.

User settings

Defaults are read from a TOML config file with profiles. The default location is ~/.ts-sast/config and the file is created on first run with an empty default profile.

[default]
format = "sarif"

[ci]
format = "sarif"
fail_on_findings = true
  • ts-sast -p ci scan ... selects the ci profile
  • ts-sast --config <path> scan ... uses a different config file
  • environment variables prefixed with TS_SAST_ override options, for example TS_SAST_SCAN_OUTPUT_PATH=findings.sarif
  • a tsproject.toml in a scanned directory provides per-project defaults with the same keys

Exit codes

  • 0 - scan completed (also when nothing was found)
  • 1 - findings were reported and --fail-on-findings was given
  • 2 - usage error, a backend executable was not found, or a backend failed

What the scan does not do

  • It does not follow data flow. A rule fires on a pattern at a line; whether the value at that line is attacker controlled is for the reviewer to judge. Rule descriptions say what to look for.
  • It does not compile or run the code. Files that DevSkim cannot read are skipped, not reported.
  • It does not report Declare statements themselves for the Win32 API rules, only the call sites.