Find the flaw in the line that ships it.

What gets scanned, and when

Unless the workspace policy is off, every branch push, every green CI build and every release is scanned, and anyone with read access can start one by hand (30 an hour per workspace). After the first scan of a repository, a scan reads only the files changed since the last one and carries the rest. Each commit gets a tilldev/sast check, which a branch rule can require like any other.

JavaScript and TypeScript, Python, Go, Java, Kotlin, Swift and Dart are read, along with Android manifests and network security config, and iOS Info.plist. Comments are ignored, and so is text inside string literals. Tests, vendored and generated code, minified bundles and files over 1 MiB are skipped. A scan that passes a size limit is marked partial, so a clean result is never claimed for code that wasn’t read.

# Scan the default branch head and list what was found.
tilldev forge sast acme-api

# A branch or tag; wait for the result. Exits 1 when a finding blocks, 2 while not scanned.
tilldev forge sast acme-api --ref feature/login --wait

# In CI: fail on anything high or worse, whatever the workspace policy says.
tilldev forge sast acme-api --commit "$GIT_COMMIT" --fail-at high --wait

# Every active finding across the default branches you can read.
tilldev forge sast findings --severity high

Warn, or block merges

Owners and admins set the policy in TillForge → Code scanning, with the CLI or through the API. A change re-grades recent commits and re-posts their checks.

# Owners and admins.
tilldev forge sast policy --mode block --block-at high
tilldev forge sast accept acme-api <scan-id> <finding-id> --reason "the id is parsed as an integer first"
tilldev forge sast exceptions acme-api
tilldev forge sast withdraw acme-api <exception-id>

Accepting a finding

When a finding is safe where it stands, an owner or admin accepts it with a reason from the repository’s Findings tab or with forge sast accept. The acceptance follows the rule, the file and the text of the line, so it survives edits elsewhere and lapses the moment that line changes. Withdrawing one makes the finding count again. Every decision is in the audit log.

To keep the reason next to the code, put an allow comment on the line or the line above:

// tillforge:allow-code sql-injection table name comes from a fixed list
db.query("select count(*) from " + TABLES[kind])

The 15 rules

Each rule names its CWE and its OWASP Top 10 and MASVS categories, so findings line up with the frameworks your auditors use. tilldev forge sast rules prints the same list.