BlogBlogA post on somebody's own site or a community platform. Nobody edits it after publication, so it dates from the day it was written.See every one →SAP Community
How to Scan Custom ABAP for Security Issues in Eclipse (Step-by-Step)
Written by someone who works on the tool, this is a setup walkthrough for the RedRays ABAP Scanner Eclipse plugin: get a demo API key, install the plugin via an update site, point it at a backend, and scan an ABAP object from the Project Explorer. Findings for SQL/ADBC injection, OS command execution, path traversal, missing AUTHORITY-CHECK and similar are grouped by severity with a CVSS score and an automated exploitability check, and a REST API extends the same scan to a CI/CD allow/block gate on a transport.
Where it sits
Explains
Static analysisABAPStatic analysisCatching problems in code before it runs: naming, obsolete statements, security findings, and compatibility with a target environment. Style linting, security scanning and cloud-readiness checks are often treated as one concern.
Source
reachable
Who is behind it
vahagnauthor
Properties
About this work
Group by
Piece, what it offersStill applies
SAP BAIP, ABAP environment – How to build partner solutions and get them certifiedSAP BAIP, ABAP environment – How to build partner solutions and get them certifiedA Devtoberfest 2026 session on the two ways a partner ships an ABAP Cloud solution built on SAP BTP ABAP environment, which the session calls the ABAP environment of SAP Business AI Platform: software delivery, where an add-on product is published with the solution ID from SAP Store onboarding and the customer discovers and deploys it into their own system, and service delivery, where the partner operates the same add-on as a multi-tenant SaaS and a new version is deployed rather than published again. That is the ABAP environment edge; the static analysis edge rests on the quality steps shown in the landscape portal, where the Manage Continuous Testing app released with 2608 runs an ATC check variant against a configured system on a recurrence pattern, beside test product version builds and managed test tenants. The second half walks through the SAP Integration and Certification Center process and the three BTP certification options open to an add-on product.SAP Developers, published 2026-10-12
News from Custom Code Migration: ECC to SAP S/4HANA Powered by Agentic AINews from Custom Code Migration: ECC to SAP S/4HANA Powered by Agentic AIA Devtoberfest 2026 session (ABA-23) on what SAP has added to the ECC to SAP S/4HANA custom code migration tools, demonstrated across a live ECC and an S/4HANA system. The first half stays deterministic and explains static analysis in that process: the custom code migration app's scoping over ABAP test cockpit findings, an explain of a legacy report and of an S/4HANA simplification finding, and transferable quick fixes exported from the app and applied on the ECC system through the SAP GUI ATC transaction before conversion. The second half runs the S/4HANA custom code migration agent in ABAP Development Tools for Eclipse: GitHub Copilot drives the ADT MCP Server's ATC and quick-fix tools in a loop, SAP Joule for Developers, ABAP AI capabilities produces the AI code proposals behind it, and only the high-confidence ones are written into the code, the rest left as comments in one transport request.published 2026-09-28
How to extend ABAP Test Cockpit on SAP BTP for custom use casesHow to extend ABAP Test Cockpit on SAP BTP for custom use casesWalks through the released, C1-contract APIs and CDS views for extending ABAP Test Cockpit on SAP BTP: the single entry point CL_SATC_API=>CREATE_API_FACTORY, reading a run's findings and headers through SATC_API_FINDINGS and SATC_API_RESULT_HEADERS, starting synchronous local ATC runs for a transport, approving or rejecting exemptions programmatically, configuring approver responsibility areas without a UI, and implementing a custom check through IF_CI_ATC_CHECK. Code snippets show each API in use, including the CDS views that join ATC results to the Custom Code Migration app's own findings.OlgaDolinskaja, published 2026-05-20
ABAP Development Automation with ARC-1 and GitHub WorkflowsABAP Development Automation with ARC-1 and GitHub WorkflowsA sample repository puts an ABAP package into GitHub with abapGit and connects GitHub Actions to ARC-1 on BTP through an API key with no write tools, so abaplint on the diff, ABAP Unit and ATC through SAPDiagnose, label-triggered Copilot and Claude reviews, and ST22 dump triage all run as checks on a pull request. The review case is PR #14, where a SAPRead of the activated method let Claude state that a direct SELECT from MARA was new in the PR and not yet active in SAP, which a diff-only review cannot know. The test gate reads activated objects, so a team that pushes before activation needs a sandbox or a pull-and-activate step, and pulling a merged change back into SAP is named as the next step, not built.published 2026-05-12
Taking Control of Clean Core: When to Use Project Kernseife in addition to Standard SAP ToolsTaking Control of Clean Core: When to Use Project Kernseife in addition to Standard SAP ToolsWalks through how SAP's standard path classifies custom ABAP extensions into Clean Core Levels A through D, running ABAP Test Cockpit against the Cloudification Repository's release status for each SAP object an extension touches, then feeding results into the RISE with SAP Methodology Dashboard in SAP Cloud ALM. Contrasts that with Project Kernseife, an open-source custom ATC check that lets a team override SAP's classification with project-specific rules, define its own successor objects (including custom wrappers), and expose a Score and Potential Score per finding through a CDS view for prioritizing cleanup — at the cost of owning and maintaining that classification. States which situations favor each: Kernseife where the standard rules are too rigid for the project's reality, the standard dashboard where cross-system comparability and low maintenance effort matter more.LBretschneider, published 2025-11-04
Patterns for using LLMs in ABAP developmentPatterns for using LLMs in ABAP developmentLars Hvam compares eight ABAP development setups: assistance in SE80 or Eclipse, virtual files and MCP over ADT, a centrally managed MCP service, sandboxes, local Git, Git with read-only system context, and temporary ABAP systems for development and CI. The overview describes where source changes, review and system access happen, including abapGit synchronization and abaplint checks. It is dated March 2026; its risk, cost and autonomy ratings are the writer’s assessments.
Rethinking security for modern SAP solution landscapesRethinking security for modern SAP solution landscapesWhere risk goes when clean core moves custom logic out of SAP S/4HANA: into integration flows, CAP extensions, ABAP Cloud code and platform configuration, told through real attack stories, then scanning code, modelling attack paths, adding security gates to CI/CD pipelines and automating safely with Terraform. The scanning edge is to static analysis, the atlas's concern for security findings in ABAP code; the abstract lists the four surfaces and the four practices and describes none of them. A TechEd 2026 session (Wednesday 28 October, Berlin), presented by Tsovinar Chugaszyan, written here from SAP's abstract; the recording is not yet published.
Details
Graph
Static analysiscapability, core and community
SAP Communitypublishing source
SAP Communityabap-development-tag
Source
Type
blog
Published on
Host
community.sap.com
Discovered via
First seen
History
- Entered the atlasDiscovered via SAP Community · abap-development-tag.
For your agent
- Ref
content:how-to-scan-custom-abap-for-security-issues-in-eclipse-step-by-step- JSON
- /content/how-to-scan-custom-abap-for-security-issues-in-eclipse-step-by-step.json
- MCP
- Connecting an agent