Contrast Scan is a static application security testing (SAST) tool that scans code to identify vulnerabilities in early stages of development. The solution runs in development pipelines, integrating into CI/CD tooling to enable security testing during commits or pull requests. The tool provides static code scanning with support for over 30 languages and frameworks. Applications are scanned by uploading source code or bytecode files. Different scan engines are used depending on code type, with Java binary scans for JAR or WAR files and source code scans for artifacts in most languages. The solution uses a risk-based scanning algorithm and security ruleset to perform analysis on exploitable data paths while filtering out false positives. Scans can be initiated on commit or pull request through command-line interface, build automation, API call, or code upload through the Contrast UI. The tool provides remediation guidance down to the specific line of code. Contrast Scan is integrated as part of the Contrast Application Security Platform with unified visibility across SAST, interactive application security testing, runtime protection and observability, and software composition analysis.
