SAST (Static Application Security Testing)

SAST reads your source code and looks for security flaws in it without executing anything. It parses each file into a syntax tree, builds a model of how data moves through the program, and reports the places where untrusted input can reach an operation that should not receive it — a SQL query, a shell command, a file path, a deserialiser.

"Static" is the whole trade-off. Because nothing runs, SAST can reach every branch, including the error paths and the code behind a feature flag that nobody has enabled yet. Because nothing runs, it also cannot know which of those branches your deployment actually takes, which is where its false positives come from.

SAST catches the whole class of bugs that come from the code you own: injection, path traversal, unsafe deserialisation, hardcoded secrets, weak cryptography. SCA will never find these, because they are not in a dependency, and DAST will only find them on the routes it happens to exercise.

It is also the only technique that works before the code is deployable. A finding at pull-request time is a five-minute change; the same finding after release is an incident, a patch and a disclosure. That is the entire argument for running it in CI.

The reason SAST has a poor reputation is precision, not coverage. A tool that flags every call to a dangerous function will be right occasionally and ignored permanently. What distinguishes a usable SAST engine is how aggressively it discards flows that cannot complete.