Static Code Analysis (SAST) uses AI to automate detection, validation, and remediation across the vulnerability management life cycle.

Detection

Detection capabilities include identifying potentially malicious intent in pull requests, and using LLMs to scan for vulnerabilities in your codebase.

Malicious PR protection

Malicious PR protection uses LLMs to scan PRs submitted to your repositories’ default branches for harmful code changes, including:

• Code injection
• Secret exfiltration attempts
• Malicious package pushes
• CI workflow compromise

For examples, see the tj-actions/changed-files breach (March 2025), obfuscated malicious npm packages (September 2025), and the malicious PR protection announcement blog post.

In the Security Signals Explorer, find malicious PR detections by narrowing the Source or Scope facet to datadog-code-security. Filter by malicious or benign verdicts using the Code Security > Scan Verdict facet, or search directly:

• source:datadog-code-security
• @pr_security.scan.verdict:malicious
• @pr_security.scan.verdict:benign

For any given vulnerability, you can assign signals for investigation, create a security case, declare an incident, or run a workflow.

AI-native SAST

AI-native SAST is available only for Datadog-hosted scans.

AI-native SAST uses LLMs to detect security vulnerabilities by reasoning about how data flows through your code. Unlike rule-based static analysis, AI-native SAST can contextually identify vulnerabilities using a two-phase approach:

1. Detection: An LLM scans each file and reasons about whether user-controlled data can reach a dangerous operation without being sanitized.
2. Verification: A second LLM independently re-evaluates each candidate finding through taint analysis, confirming or dismissing each finding to reduce false positives.

To enable AI-native SAST, in your source code management integration settings, toggle Enable AI SAST. You can enable it for all repositories or specific repositories.

If enabled, AI-native SAST runs in parallel with rule-based static analysis, and its findings take precedence for vulnerability types both methods cover.

AI-native SAST is supported for these languages:

• C#
• C++
• Dart
• Elixir
• Go
• Java
• JavaScript
• Kotlin
• PHP
• Python
• Ruby
• Rust
• Swift
• TypeScript

AI-native SAST uses language-specific rulesets (for example, python-ai_sast) in the Code Security sast configuration. For the full list of ruleset names and how to select or exclude them for Datadog-hosted scans, see Static Code Analysis (SAST) Configuration.

Validation

False positive filtering happens after a scan completes. Two layers of filtering are available: baseline false positive filtering, and agentic filtering that gathers cross-file context for a subset of rules.

False positive filtering

Bits AI reviews SAST findings and assesses whether they’re likely true or false positives, and includes a short explanation of its reasoning.

To narrow down your triage list in Code Security SAST Vulnerabilities, enable Filter out false positives, which applies the -bitsAssessment:"False Positive" query.

Agentic false positive filtering

Agentic false positive filtering is an enhanced version of baseline false positive filtering. Instead of assessing only the code in front of it, Bits AI gathers cross-file context. It reads related files, searches for symbols, and inspects nearby directory structure.

Agentic false positive filtering applies only for injection-related SAST rules, such as SQL injection and command injection.

Custom context

Custom context lets you add rule-specific guidance that Bits AI uses when assessing findings for all false positive filtering. Use custom context to describe organization-specific frameworks, sanitizers, validation patterns, or codebase details.

Custom context applies at the organization and rule level, and only to security category SAST rules in Datadog’s default rulesets, not to custom rules. Review or add custom context in the side panel for SAST rules.

Remediation

Bits Code generates code fixes for vulnerabilities, either as a single fix, or as an automation.

1. In Code Security SAST Vulnerabilities, select a vulnerability to open a side panel with details about the finding and the affected code.
2. In the Next Steps sidebar, click Remediate with AI, then choose an option:
   • Single fix: Review a proposed diff, ask follow-up questions, edit the patch, and create a pull request to remediate a single vulnerability. If a fix has already been generated, select View fix and create PR to view the existing remediation session.
   • Create automation: Generate fixes automatically as they’re found or on a schedule. Selecting this option opens a modal with the Remediate SAST vulnerabilities action pre-filled. Complete the form, including specifying a trigger and output, then click Create Automation.

You can review and validate changes before merging by viewing session details, including:

• The original security finding and proposed code change.
• An explanation of how and why Bits Code generated the fix.
• CI results (if enabled) to validate the patch is safe to deploy.
• Options to refine the fix or Create PR to apply the changes to your source code repository.

Further reading

役立つドキュメント、リンク、記事:

Introducing our open source AI-native SASTBLOG Detect vulnerabilities in LLM applications with Datadog’s AI-native SASTBLOG Using LLMs to filter out false positives from static code analysisBLOG Reduce SAST false positives with agentic evaluation and Bits MemoriesBLOG Introducing Bits Code for Code SecurityBLOG