Contrast Code
Contrast Code is an AI-powered orchestration engine that integrates static analysis tools into the Contrast platform. It scans your repositories for security vulnerabilities using Static Application Security Testing (SAST) and Software Composition Analysis (SCA) then enriches those findings with AI triage and runtime context from instrumentation sensors in Contrast Security. The result is a prioritized, correlated view of risk from code to production without adding new agents or sensors to your existing pipeline.
Contrast Code runs as part of your GitHub CI/CD pipeline with the Northstar GitHub app and a GitHub Action. When a scan completes, findings are captured in the Contrast platform as Observations. They are scored into Issues alongside any runtime data from Contrast Assess (IAST) and Contrast Application Detection and Response (ADR). You can also view repository-to-application linkage in the Explorer, which shows which repositories map to which running applications.
Contrast Code is available as part of the Contrast Platform SKU and is licensed per active committer, which is an account that commits code to a monitored repository within any consecutive 30-day period.
Note
Monorepos are not fully supported in application models at this time.
AI Triage
AI Triage is an automated analysis step that runs on SAST findings before they are ingested into the Contrast Platform. Rather than surfacing every raw static finding directly to your security team, AI Triage examines each result in context and classifies it as a likely true positive or false positive.
For each finding, AI Triage produces three pieces of information:
Classification: Whether the finding is likely a true positive or a false positive
Justification: The reasoning behind the classification
Work performed: A description of what the AI agent analyzed to reach its conclusion
This information appears in the detailed view for each Observation in the platform. Issues resulting from false-positive findings are automatically moved to a Closed state by default.
AI Triage applies only to SAST findings. AI Triage will analyze for 10 minutes by default, although the duration is configurable.
Supported languages
Contrast Code supports the following languages. Additional language support for SAST and/or SCA will be added over time.
Table key:
|
Note
For assistance, contact Contrast support.
Language | Static SCA (cdxgen) | SAST (opengrep) |
|---|---|---|
Android |
| |
Apex |
| |
Bash |
| |
C |
| |
C++ |
| |
.NET/C# |
|
|
Clojure | ||
Dart |
|
|
Dockerfile |
| |
Elixir |
|
|
Go |
|
|
Haskell | ||
HTML |
|
|
Java |
|
|
JavaScript |
|
|
JSON |
|
|
Jsonnet | ||
JSP |
| |
Julia |
| |
Kotlin |
| |
Lisp | ||
Lua | ||
Objective-C | ||
OCaml |
| |
PHP |
|
|
Python |
|
|
R |
| |
Ruby |
|
|
Rust |
|
|
Scala |
| |
Scheme | ||
Shell |
| |
Solidity |
| |
Swift |
|
|
Terraform |
| |
TSX | ||
TypeScript |
|
|
Visual Basic | ||
XML |
| |
YAML |
|
|
Get started
To onboard your repositories to Contrast Code, install the Northstar GitHub app.