Dependency scanning covers the packages, SAST covers your own code, secrets detection covers keys in repos, container scanning covers the image, and API and web testing cover the running service. None of them test model behavior such as prompt injection, which needs separate evaluation and red teaming.
The map
| Part of the LLM app | Scan type | What it can find | What it cannot find |
|---|---|---|---|
| Python and JS packages | Dependency scanning (SCA) | Known vulnerable versions, license issues | Zero days with no advisory yet |
| Your handlers, auth, tenant code | SAST | Injection, unsafe deserialization, hardcoded secrets | Runtime configuration flaws |
| Repos and CI logs | Secrets detection | Provider and cloud keys | Keys shared outside repos |
| Container image | Image scanning | OS and runtime package flaws | Logic bugs in your app |
| Public API | API testing | Missing auth, broken object access | Flaws behind unreachable routes |
| Web front end | DAST | XSS, misconfigured headers | Model misbehavior |
| Prompts and agent tools | Evaluation and red teaming | Injection, excessive agency | Package vulnerabilities |
Why the last row matters
OWASP lists prompt injection as LLM01:2025 and excessive agency as LLM06:2025. A scanner reads code and packages. It does not send crafted inputs through your model and judge the result. Plan a separate test pass, and turn each finding into a regression test. See turning red team findings into regression tests.
Where scanners help with AI specific risks
- Supply chain (LLM03): dependency scanning and an inventory of components.
- Improper output handling (LLM05): SAST can flag model output passed into a shell, a query, or HTML without checks.
- Sensitive information disclosure (LLM02): secrets detection and log review catch part of this.
- Unbounded consumption (LLM10): API testing can confirm limits exist.
How to choose what to run first
Start with dependency scanning and secrets detection, add SAST when you own meaningful logic, and add API and web tests once there is a public surface. Run each at the point where it is cheapest to act on: pull requests for code and packages, build time for images, scheduled for deployed services.
Try it yourself
Open the SAST demo and look at how a finding points to a file and line, then compare that with what a dependency finding looks like.
Click through it at your own pace, or open it full screen.
A short note on Safeguard
Safeguard offers dependency scanning, SBOMs, and policy gates, with scan results ranked by reachability. Try a free scan at gold.safeguard.sh/scan.
Quick check
Can SAST find prompt injection?
Not in the model itself. It can flag risky handling of model output in your code, which is a related but different problem.
Do I need all of these at once?
No. Add them in order of the surface you actually expose.
Sources
Last reviewed: 19 October 2026.
