SAST: Static Application Security Testing

Static Application Security Testing (SAST) tools analyze an application's source code, bytecode, or binary code for security vulnerabilities without actually executing the application. Think of it as proofreading a book for plot holes before it goes to print.

How it Works:

• Scans code for patterns that indicate common vulnerabilities (e.g., SQL injection, XSS, buffer overflows).
• Builds a model of the application's control flow and data flow.
• Often integrated into CI/CD pipelines for early detection.

Pros:

• Finds vulnerabilities early in the development lifecycle (cheaper to fix!).
• Can analyze 100% of the codebase.

Cons:

• Can have high false positive rates.
• May not understand the full context or runtime environment.
• Doesn't find runtime or configuration issues.