reference Flags

--gitlab-sast

Accepted by
opengrep scan, opengrep ci
See also
--gitlab-secrets, --json, --sarif, --output, --gitlab-sast-output, --junit-xml, metadata

Prints a GitLab SAST report, the document that a GitLab job provides as its sast artifact. Its top level holds $schema, version, scan, which describes the run, and vulnerabilities, the findings. Each vulnerability has the category sast, the message of the rule as its message and description, a severity derived from that of the rule, the location, and an identifier built from the file and the rule id. The metadata key source of the rule sets the URL of the identifier, and confidence adds a confidence detail.

--gitlab-sast-output writes the same document to a file. Only one format can be printed to standard output.

Examples

The shape of the report

rule.yaml
rules:  - id: find-eval    pattern: eval(...)    message: found eval    languages: [python]    severity: WARNING
app.py
eval(1)
Command and result
$ opengrep scan --config rule.yaml --gitlab-sast app.py 2>/dev/null | jq .
{
  "$schema": "https://gitlab.com/gitlab-org/security-products/security-report-schemas/-/blob/master/dist/sast-report-format.json",
  "version": "15.0.4",
  "scan": {
    "start_time": "2026-09-15T09:12:22",
    "end_time": "2026-09-15T09:12:22",
    "analyzer": {
      "id": "opengrep",
      "name": "Opengrep",
      "url": "https://opengrep.dev",
      "version": "X.Y.Z",
      "vendor": {
        "name": "Opengrep"
      }
    },
    "scanner": {
      "id": "opengrep",
      "name": "Opengrep",
      "url": "https://opengrep.dev",
      "version": "X.Y.Z",
      "vendor": {
        "name": "Opengrep"
      }
    },
    "version": "X.Y.Z",
    "status": "success",
    "type": "sast"
  },
  "vulnerabilities": [
    {
      "id": "752d5925-3fdf-44e8-5075-75f6f0d3364c",
      "category": "sast",
      "cve": "app.py:568470d013cd12e4f388206520da39ab9a4e4c3c6b95846cbc281abc1ba3c959:find-eval",
      "message": "found eval",
      "description": "found eval",
      "severity": "Medium",
      "scanner": {
        "id": "opengrep",
        "name": "Opengrep",
        "vendor": {
          "name": "Opengrep"
        }
      },
      "location": {
        "file": "app.py",
        "start_line": 1,
        "end_line": 1
      },
      "identifiers": [
        {
          "type": "opengrep_type",
          "name": "Opengrep - find-eval",
          "value": "find-eval",
          "url": "not available"
        }
      ],
      "flags": [],
      "details": {}
    }
  ]
}