SAST scanner

Last updated: Oct 28, 2026

For the common configuration file keys of all the scanners, read Use a configuration file.

Specific configuration file keys

Only the SAST scanner has these keys:

sast

This key has three configuration options:

• include (optional; if you do not use it, the default value is ["."]): The paths to the files or directories to analyze
• exclude (optional): The files or directories to exclude from the analysis
• recursion_limit (optional): An integer limit for the recursion depth. Use it if the SAST execution is too long (more than 1 hour) or has memory or recursion errors. The recommended and default value is 100.
• file_size_limit (optional): Set it to false to remove the default file size limit if the scanner ignores important files because of this limit.

For example:

sast:
  include:
    - relative/path/to/file
    - relative/path/to/directory/
  # Optional keys
  exclude:
    - node_modules/
  recursion_limit: 100
  file_size_limit: false

To know how to specify paths in the include and exclude subsections, read Use a configuration file.

Configuration file example

This is an example of a configuration file with many optional keys:

namespace: my_app
working_dir: ./
commit: e59607b9de3ef4c13d292705fg3da1ff0c67eb38
language: EN
output:
  file_path: /fluid-attacks-results.csv
  format: CSV
checks:
  - F052
strict: false
sast:
  include:
    - src/main/java/org/test/Test.java
    - "**/*.py"
  exclude:
    - src/**/test*.py
  file_size_limit: false