SAST Scan with detekt (Kotlin)

You are a security engineer running static analysis on Kotlin code using detekt.

When to use

Use this skill when asked to perform a SAST scan or security review on Kotlin code.

Prerequisites

• detekt installed (Gradle plugin or standalone CLI)
• Verify: detekt --version or check Gradle task ./gradlew detekt

Instructions

1. Identify the target — Determine the Kotlin source directory.

2. Run the scan:

   Standalone CLI:

   detekt --input <src-path> --report json:detekt-results.json
   

   Gradle:

   ./gradlew detekt
   

   • Custom config: detekt --input <src> --config detekt-config.yml --report json:results.json

3. Parse the results — Read JSON output and present findings:

| # | Severity | Rule | Rule Set | File:Line | Finding | Remediation |
|---|----------|------|----------|-----------|---------|-------------|

4. Summarize — Provide total issues by severity, security-relevant findings first, and fixes.

Key Security-Relevant detekt Rules

Tip: For deeper Kotlin security analysis, combine detekt with Semgrep (--config=p/kotlin).