SAST
Static application security testing
Tools analyze source code, bytecode or binaries without running them, tracing data from sources to sinks to find weaknesses such as injection. They see every code path but report false positives and miss flaws that depend on runtime configuration.
- Defined in
- OWASP: Source Code Analysis Tools
Covered in
Combine static and dynamic tests around a verified finding
Use analysis tools to find evidence, then retain an application regression that demonstrates the failure and the fix.
Choose and evaluate application security testing tools
What SAST, DAST, IAST, SCA, secrets, IaC, container and API scanners and ASPM each find and miss, where each runs, how to evaluate them on a seeded repository with per-CWE scoring and triage cost, and which to adopt first.
Place each security control in the pipeline and decide what it blocks
Put secrets scanning, SAST, SCA, IaC and image scanning, DAST, fuzzing, attestation and admission control where each sees the right input, block only on findings a developer can act on, and deploy only images the pipeline has attested.
Practice: Local project: Repair a security pipeline for GitHub Actions and GitLab CI