Static Application Security Testing

Static Application Security Testing, or SAST, analyzes code at rest. It searches source code, and sometimes compiled artifacts, for patterns associated with security weaknesses. You run it before the application executes, so it is a white-box testing technique.

The useful mental model is code becomes a graph of security-relevant paths:

source code → parse and model → apply rules or queries → findings → triage → fix or suppress with evidence

A SAST finding is a hypothesis about code. It may identify an untrusted value reaching a dangerous operation, a weak cryptographic choice, hard-coded credentials, or a missing validation step. It is not automatically a confirmed vulnerability. The analyst must decide whether the path is reachable, whether controls already make it safe, and whether the finding matters in the deployed application.