What is SAST?

SAST (Static Application Security Testing) is a method of application security testing through source code analysis without running it. SAST detects vulnerabilities at an early stage of development, implementing the “Shift Left” approach.

How Does SAST Work?

1. Code Analysis: Scanning source code, bytecode, or binary
2. Data Flow Analysis: Tracking data flow (tainted data)
3. Control Flow Analysis: Analyzing execution paths
4. Pattern Matching: Detecting known vulnerability patterns
5. Reporting: List of vulnerabilities with code location

What Does SAST Detect?

Category	Examples
Injection	SQL injection, OS command injection, LDAP injection
XSS	Reflected XSS, Stored XSS, DOM-based XSS
Secrets	Hardcoded passwords, API keys, tokens
Crypto	Weak algorithms, hardcoded keys
Auth flaws	Broken authentication, missing authorization
Config	Insecure defaults, debug enabled
Quality	Null pointer, buffer overflow, race conditions

SAST vs DAST

Aspect	SAST	DAST
When	Development	Runtime (staging/prod)
What it analyzes	Source code	Running application
Coverage	100% of code	Accessible endpoints
False positives	More	Fewer
Location	Exact line of code	URL/endpoint
Languages	Tool-dependent	Agnostic

Advantages of SAST

• Early Detection: Finding bugs before deployment
• Precise Location: Pointing to the problem line of code
• Full Coverage: Analysis of all code, not just accessible functions
• CI/CD Integration: Automatic scanning on every commit
• Developer Education: Immediate feedback

SAST Challenges

• False Positives: Requires result triage
• Language Support: Different tools for different languages
• Custom Frameworks: May not understand custom libraries
• Build Time: Additional time in pipeline

Popular SAST Tools

Commercial

• Checkmarx
• Veracode
• Fortify (Micro Focus)
• Snyk Code
• SonarQube (Enterprise)

Open Source

• SonarQube (Community)
• Semgrep
• Bandit (Python)
• Brakeman (Ruby)
• ESLint Security Plugin (JavaScript)

SAST in CI/CD

Code → SAST Scan → Build → DAST → Deploy
         ↓
    Block on Critical
    Warn on Medium

Best Practices:

1. Scan on every pull request
2. Block merge on critical vulnerabilities
3. Set baseline - don’t introduce new issues
4. Integrate with IDE for immediate feedback
5. Regularly update scanning rules