SAST
Also known as: Static Application Security Testing
SAST (Static Application Security Testing) analyzes source code, without running the application, to find security vulnerabilities — insecure patterns, known-dangerous function usage, potential injection points — early in development, before the code is even built or deployed.
Because SAST works directly on source code, it integrates naturally into the development workflow itself — running as part of code review or on every commit in CI, giving developers feedback within minutes of writing vulnerable code, rather than waiting for a later security review or a DAST scan against a deployed environment.
Its main limitation is a tendency toward false positives — flagging code patterns that look risky in isolation but are actually safe in context — which means SAST findings typically need a human security review to triage, rather than being treated as automatically actionable the way a compiler error would be.
