Static Application Security Testing (SAST)

SAST tools scan code at rest to find security flaws early in development, before the application runs.

What SAST detects

• SQL injection vulnerabilities.
• Cross-site scripting (XSS) patterns.
• Buffer overflows and memory issues.
• Hardcoded secrets and credentials.
• Insecure cryptographic implementations.
• Input validation flaws.

Popular SAST tools

• Commercial: Checkmarx, Veracode, Fortify, Snyk Code.
• Open source: Semgrep, SonarQube, Bandit (Python), ESLint security plugins.

CI/CD integration

• Run on every pull request.
• Block merges for critical/high findings.
• Track vulnerability trends over time.
• Generate SARIF reports for GitHub Security tab.

Advantages

• Finds issues before code reaches production.
• Covers all code paths (not just executed ones).
• Provides specific line-of-code remediation guidance.
• Scales to large codebases automatically.

Limitations

• False positives require triage effort.
• Cannot detect runtime or configuration issues.
• May miss business logic flaws.
• Language-specific tooling required.

Best practices

1. Start with high-confidence rules to reduce noise.
2. Integrate into IDE for immediate developer feedback.
3. Establish baseline and track new findings only.
4. Combine with DAST and SCA for comprehensive coverage.