-[`spotbugs`](https://gitlab.com/gitlab-org/security-products/analyzers/spotbugs)(SpotBugs with the Find Sec Bugs plugin (Ant, Gradle and wrapper, Grails, Maven and wrapper, SBT))
-[`spotbugs`](https://gitlab.com/gitlab-org/security-products/analyzers/spotbugs)(SpotBugs with the Find Sec Bugs plugin (Ant, Gradle and wrapper, Grails, Maven and wrapper, SBT))
The analyzers are published as Docker images that SAST will use to launch
The analyzers are published as Docker images that SAST uses to launch
dedicated containers for each analysis.
dedicated containers for each analysis.
SAST is pre-configured with a set of **default images** that are maintained by
SAST is pre-configured with a set of **default images** that are maintained by
...
@@ -77,12 +77,12 @@ variables:
...
@@ -77,12 +77,12 @@ variables:
SAST_DEFAULT_ANALYZERS:"bandit,flawfinder"
SAST_DEFAULT_ANALYZERS:"bandit,flawfinder"
```
```
`bandit` runs first. When merging the reports, SAST will
`bandit` runs first. When merging the reports, SAST
remove the duplicates and will keep the `bandit` entries.
removes the duplicates and keeps the `bandit` entries.
### Disabling default analyzers
### Disabling default analyzers
Setting `SAST_DEFAULT_ANALYZERS` to an empty string will disable all the official
Setting `SAST_DEFAULT_ANALYZERS` to an empty string disables all the official