Code Security & Quality / SAST
Find security weaknesses in your source code before they move further through delivery.
Identify potential security issues in source code and give developers clearer context for investigation. Qualipr’s static analysis helps teams examine code for patterns associated with security weaknesses without relying only on runtime testing.
-
Clear findings
File and line, severity, and code context in one place.
-
Easy to prioritize
Severity and context help your team decide what to fix first.
-
Code Quality
Track code quality issues alongside security risks.
-
Shared Runner included
Scans run on shared capacity that comes with your plan.
Code Security & Quality
Static Application Security Testing (SAST)
Placeholder: the real product screenshot will replace this image See where a potential weakness was detected, with the rule and code context needed to investigate it.
The problem
Security issues can remain hidden in a codebase until they are discovered during testing, review, or after deployment. Teams need a way to examine source code consistently and understand which findings deserve attention.
How it works
Static analysis examines source code against configured analysis rules and identifies matching patterns. Findings are associated with code locations and relevant rule information so teams can investigate them in context.
What you can do
- Analyze supported source code using static analysis.
- Identify security-related findings.
- Review findings in the context of their repository and code location.
- Use rule and finding context to support investigation and remediation.
- Apply custom rules and scan for exposed secrets.
What you get
A structured view of code-level findings that helps developers understand where a potential weakness was detected and what to investigate next.
Where it fits
Code findings can be reviewed and managed through the platform’s security finding workflows.
Pricing
LOC-based plans
SAST & Code Quality pricing is based on LOC (lines of code) capacity. Start free for up to 50,000 LOC, then scale in steps with your codebase.
About LOC counting
LOC is the number of lines of code analyzed. The full definition, counting method, and exclusions will be published in the documentation. Contact us if you need help choosing the right plan.
| Capacity | Price / month |
|---|---|
| 100K LOC | IDR 434,000 |
| 200K LOC | IDR 1,270,000 |
| 300K LOC | IDR 2,550,000 |
| 500K LOC | IDR 4,280,000 |
| 700K LOC | IDR 5,750,000 |
| 1M LOC | IDR 8,550,000 |
| 1.5M LOC | IDR 12,890,000 |
| 1.9M LOC | IDR 16,080,000 |
FAQ
Related questions
What is the difference between SAST and DAST?
SAST (Static Application Security Testing) analyzes source code without running the application, so security and quality issues surface as code is written. DAST (Dynamic Application Security Testing) tests a running web application or API from the outside, the way an attacker sees it. The two complement each other.
What does the Free plan include?
The Free plan includes SAST and Code Quality Analysis for up to 50,000 LOC, up to 5 users, and the Shared Runner. Scans run on the main branch only. The other Application Security Suite capabilities are available from the Team plan.
Can the Free plan scan branches other than main?
No. The Free plan scans the main branch only. Scanning other branches is available on Team and Enterprise.
Does the Free plan support Merge Request scans?
No. The Free plan does not include Merge Request scans. Choose Team or Enterprise if you need to check changes before they are merged.
How is Team pricing calculated?
Team pricing is based on monthly LOC (lines of code) capacity, from IDR 434,000/month for 100K LOC up to IDR 16,080,000/month for 1.9M LOC. The Shared Runner is included. Needs above 1.9M LOC are handled through Enterprise.
Make security easier to understand, and easier to act on.
Bring your code, applications, dependencies, infrastructure, and security governance into one connected platform.