SAST scanner

Last updated: Mar 24, 2026

General configuration file keys

Here is an overview of the general configuration file keys. Remember that this applies to all of Fluid Attacks' scanners.

namespace: myapp
output:
  file_path: ./Fluid-Attacks-Results.csv
  format: CSV
working_dir: .
language: EN

Specific configuration file keys

The following keys are available only for the SAST scanner:

file_size_limit

By default, there is a file size limit to prevent long analysis times. Set file_size_limit to false to remove the limit if crucial files are omitted because of it:

file_size_limit: false

sast

This key has three configuration options:

• include (mandatory): Paths to files or directories to analyze
• exclude (optional): Files or directories to exclude from the analysis
• recursion-limit (optional): An integer limit for recursion depth, which is useful if SAST execution takes too long (over 1 hour) or encounters memory/recursion errors (the recommended and default value for this option is 1000)

For example:

sast:
  include:
    - relative/path/to/file
    - relative/path/to/directory/
  # Optional keys
  exclude:
    - glob(**/node_modules/)
  recursion-limit: 1000

Specify paths in the include/exclude subsections

You can specify your paths in two different ways:

• Using a path relative to the working directory (if the working_dir key is not defined, the working directory is automatically set to the same directory you called the scanner execution), for example:

namespace: namespace
working_dir: /test/directory
sast:
  include:
    - src/main/java/org/test/Test.java

• Using Unix-style globs, relative to working_dir, for example:

namespace: namespace
working_dir: /test/directory
sast:
  include:
    - glob(*)
  exclude:
    - glob(**.java)
    - glob(src/**/test*.py)

The recommended configuration is to scan all paths of working_dir by using . in the include option:

sast:
  include:
    - .

Configuration file example

Below is an example of a highly personalized configuration file:

namespace: my_app
working_dir: ./
commit: e59607b9de3ef4c13d292705fg3da1ff0c67eb38
language: EN
output:
  file_path: /fluid-attacks-results.csv
  format: CSV
checks:
  - F052
strict: false
file_size_limit: false
sast:
  include:
    - src/main/java/org/test/Test.java
    - glob(**.py)
  exclude:
    - glob(src/**/test*.py)