Static Application Security Testing (SAST)

SAST tools examine source code or compiled versions of code to find security flaws, typically during the programming and testing phases of the software life cycle. They can be added to a developer's IDE, so issues surface while the software is being written. Finding a flaw there can save time and effort compared with finding it later in the development cycle.

SAST scales well. It can run on large amounts of software, and it can run repeatedly, for example in nightly builds or continuous integration. It identifies certain well-known vulnerabilities, such as buffer overflows and SQL injection flaws, and its output points developers to the problem by file name, location, and line number. In a CI/CD pipeline, a commit whose dependencies carry known security vulnerabilities can be marked insecure and kept from deployment, and the analysis can also find hardcoded passwords and secrets that should be removed.

SAST has limits. Many types of vulnerability are hard to find automatically, including authentication problems, access control issues, and insecure use of cryptography, and current tools identify only a relatively small percentage of application security flaws. They produce high numbers of false positives, often miss configuration issues because those are not represented in the code, and often have difficulty analyzing code that cannot be compiled.