Static Application Security Testing (SAST)
Automated code analysis that finds vulnerability patterns before anything runs — cheap, early, and only as valuable as your triage discipline.
What is SAST?
Static Application Security Testing analyzes source code (or bytecode) without executing it, tracing data flows and matching vulnerability patterns: user input reaching a SQL string (injection), unsanitized output (XSS), hardcoded secrets, dangerous deserialization, path traversal. Because it runs at commit time in CI, it’s the cheapest possible moment to catch a flaw — before code review, before deploy, before an attacker. Modern tools (Semgrep, CodeQL, SonarQube, Snyk Code) span from fast pattern rules to deep interprocedural taint analysis.
The false-positive economy
SAST’s defining constraint isn’t detection — it’s credibility. Static analysis over-approximates: it can’t always know a value was sanitized upstream, so it flags conservatively. Teams that enable every rule on day one generate thousand-finding backlogs, developers learn to ignore the tool, and real criticals drown. The discipline that works: start with a high-confidence rule set, fail builds only on new criticals (baseline the legacy findings), tune rules per-repo, and measure the tool by actioned findings, not raised ones. Semgrep’s popularity is largely this insight productized — fast, readable custom rules teams actually trust.
Where SAST sits in the family
SAST reads code; DAST attacks the running app (finds config/runtime issues SAST can’t); SCA audits dependencies (where most real-world vulnerabilities actually live — different tool, often confused); secrets scanning is its own specialized lane. Coverage means the set, not one acronym. And the 2026 wrinkle: AI-generated code raises the volume of plausible-but-unsafe patterns, making commit-time SAST more valuable — the reviewer that never gets tired.
What people get wrong
- All rules, day one — the fastest route to a muted Slack channel.
- SAST as the whole program: no dependency scanning means missing the majority of exploitable CVEs.
- Scanning without ownership: findings without a routing-and-SLA path are dashboards, not security.
Primary source: OWASP — Static Application Security Testing
Historical figures and technical concepts for informational purposes only. Not technical, professional, legal, or financial advice. Sources: Official Documentation.