SAST

Problem

A developer accidentally writes an unsafe pattern into source code. You'd like to discover it before the application even runs.

Solution — Static Application Security Testing

SAST analyzes source code or compiled artifacts for security-relevant patterns. Tools include GitHub CodeQL, SonarQube, and Semgrep. A scan step in the repository's continuous integration (CI) pipeline retrieves the code and runs the analyzer on pushes or pull requests. With repository integration configured, findings appear alongside the proposed changes so developers can fix them before merging.

Source code
    ↓
Static analysis
    ↓
Potential vulnerability

Core idea: SAST searches application code for security problems without executing the application.