> For the complete documentation index, see [llms.txt](https://scansuite.gitbook.io/scansuite/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://scansuite.gitbook.io/scansuite/usage/static-code-analysis.md).

# Static Code Analysis

Static code analysis includes the use of various security and quality tools, such as:

* **SAST (Static Application Security Testing) tools**
* **Secrets scanning**
* **Dependency checks (SCA)**
* **Infrastructure as Code (IACS) scanners**

#### Scan Types Supported

The system supports both **on-demand (single)** and **scheduled** scans. Additionally, you can configure **repository monitoring** to periodically check for updates in a target repository and automatically perform **incremental scans** on any new changes.

***

#### Step-by-Step Instructions

**1. Create a Product**

Before initiating a scan, create a new product as described on the previous page of the documentation.

***

**2. Provide Source Code**

You can supply the source code in one of the following ways:

* **ZIP Archive:** Upload a compressed folder containing one or more source code directories.
* **Git Repository Path:** Specify the repository URL (both **HTTPS** and **SSH** formats are supported).

> 📌 If the repository requires authentication, refer to the next page for setup instructions.

***

**3. Configure the Static Analysis**

Navigate to the **Static Analysis** tab and:

* Upload the ZIP archive **or** enter the Git repository path.
* Select the **main programming language** of the project.

***

<figure><img src="https://4294115650-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FnKyTIO2cfH1PztWRwJEe%2Fuploads%2FDrejz081a9P9yY4pZSPW%2Fimage.png?alt=media&amp;token=75561343-b2f3-4771-8474-74850787f74f" alt=""><figcaption></figcaption></figure>

* Choose any **additional multi-language scanners** and additional features, such as **Code Documentation generation with AI**.
* Select which scan results should be exported to Defect Dojo
* Enable AI features for scans:
  * LLM based SAST
  * Secrets verification
  * Dependency scan results enrichment

> ℹ️ Language-specific scanners will automatically be triggered based on the selected **Main Language**.

<figure><img src="https://4294115650-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FnKyTIO2cfH1PztWRwJEe%2Fuploads%2FiQoqIqscjSS8jEu2W3op%2Fimage.png?alt=media&amp;token=c2bacffd-c08e-4707-8e4e-d3c968d98b48" alt=""><figcaption></figcaption></figure>

***

**4. Submit the Scan**

* Confirm that the **Product / Engagement ID** matches the one created during product setup.
* Click **“Submit”** to start the scan.