SAST - Static Application Security Testing

What is SAST?

SAST (Static Application Security Testing) is an application security testing method that analyzes source code, bytecode, or binary files without the need to run the application. SAST tools identify security vulnerabilities and issues in code during the development phase, so you can fix them before they reach production.

#1 Cross-site scripting (CWE-79) in the 2025 CWE Top 25

#2 SQL injection (CWE-89) in the 2025 CWE Top 25

24/7 Continuous automated scanning

How SAST Works

SAST tools analyze source code using a combination of static analysis techniques. The process involves parsing the code, building an abstract syntax tree (AST), and then performing data flow analysis and pattern matching against known security patterns.

Source Code Analysis

The SAST tool parses the source code and builds an abstract syntax tree (AST) that represents the program structure.

Data Flow Analysis

The tool traces the flow of data through the application and identifies paths through which untrusted data can reach sensitive functions.

Pattern Matching

The code is compared against a database of known security patterns and anti-patterns (e.g., SQL injection, XSS, hardcoded secrets).

Report Generation

A detailed report is generated with discovered vulnerabilities, including severity, CWE classification, location in the code, and remediation recommendations.

Example: SQL Injection Detection

// Vulnerable code - SAST would flag this
String query = "SELECT * FROM users WHERE username = '" + userInput + "'";
Statement stmt = connection.createStatement();
ResultSet rs = stmt.executeQuery(query);  // SQL Injection risk!

// Secure code - parameterized query
String query = "SELECT * FROM users WHERE username = ?";
PreparedStatement stmt = connection.prepareStatement(query);
stmt.setString(1, userInput);  // Safe - parametrized
ResultSet rs = stmt.executeQuery();

Popular SAST Tools

Open Source

SonarQube

Code quality and security platform. According to the documentation, the free Community Build analyzes 22 languages; others (e.g. C/C++, COBOL) require the paid SonarQube Server and Cloud editions.

Detailed dashboards and code quality metrics
Quality Gates for automated blocking
Integration with GitHub, GitLab, Azure DevOps
Free SonarQube Community Build

Enterprise

Checkmarx SAST

Enterprise SAST, part of the Checkmarx One platform. CxSAST is available for on-premises deployment.

Advanced data flow analysis
Cloud (Checkmarx One) and on-premises (CxSAST)
Java, C#, Go, Python, COBOL, PL/SQL and more
SOC 2 Type II and ISO/IEC 27001 certified

Open Source

Semgrep

Fast and flexible SAST tool with support for custom rules and IaC scanning. The open source engine is called Semgrep Community Edition (CE).

Native GitLab SAST report output (--gitlab-sast)
Easy custom rule creation
Support for IaC security scanning
Semgrep CE is free under the LGPL-2.1 license

GitHub Native

GitHub CodeQL

Semantic analysis using QL queries with native GitHub Actions integration.

Semantic analysis using QL queries
Native integration with GitHub Actions
Free for public repositories; private ones need GitHub Code Security (Team or Enterprise plan)
Copilot Autofix suggests fixes for alerts

Enterprise

Veracode SAST

SAST service that scans both source code and compiled binaries, so it also covers third-party code without source files.

Source, binary and hybrid scanning
Policy-based reporting
Policy checks directly in the CI/CD build
AI remediation with Veracode Fix

Developer-First

Snyk Code

Scanning directly in the IDE with automatic fixes from Snyk Agent Fix (formerly DeepCode AI Fix).

Plugins for VS Code, Visual Studio and JetBrains IDEs
Snyk Agent Fix suggests fixes for findings
Developer-friendly UX
Integration with Snyk Open Source (SCA)

Integrating SAST into the CI/CD Pipeline

GitLab CI/CD Pipeline

# .gitlab-ci.yml
stages:
  - build
  - test
  - security
  - deploy

sast-scan:
  stage: security
  image: semgrep/semgrep
  script:
    - semgrep scan --config auto --error --gitlab-sast --output gl-sast-report.json
  artifacts:
    when: always
    reports:
      sast: gl-sast-report.json
  allow_failure: false  # --error exits 1 on findings, so the job fails and blocks the merge

GitHub Actions Workflow

# .github/workflows/sast.yml
name: SAST Security Scan

on:
  push:
    branches: [ main, develop ]
  pull_request:
    branches: [ main ]

jobs:
  codeql-analysis:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      security-events: write
    steps:
      - name: Checkout code
        uses: actions/checkout@v7

      - name: Initialize CodeQL
        uses: github/codeql-action/init@v4
        with:
          languages: javascript-typescript, python

      - name: Perform CodeQL Analysis
        uses: github/codeql-action/analyze@v4

Best Practice: Security Gates

Configure quality gates in your CI/CD pipeline that automatically block deployment when the SAST tool finds vulnerabilities above a certain severity threshold (e.g., Critical or High).

Benefits and Challenges of SAST

Benefits of SAST

Early detection: Vulnerabilities are discovered during development, not in production
Cheaper fixes: A bug found during development needs no hotfix, new release or incident response
Full code coverage: SAST analyzes the entire codebase, not just commonly used paths
Automation: Scanning runs automatically on every commit/merge
Developer education: Developers learn secure coding practices from reports
Compliance: Helps demonstrate secure development under NIST SSDF (practice PW.7, code review and analysis), PCI DSS 4.0.1 (requirement 6.2) and NIS2

Challenges and Limitations

False positives: SAST may report vulnerabilities that are not actual threats; OWASP lists high numbers of false positives as the main weakness
Configuration and tuning: Requires time to properly configure rules. SAST often misses environment misconfigurations because they are not in the code
Runtime vulnerabilities: SAST cannot detect issues that only manifest at runtime (DAST covers this)
Triage overhead: Developers must evaluate and prioritize findings
Legacy code: In older codebases, SAST may discover thousands of issues at once

SAST vs DAST

SAST (White-box): Analyzes source code including rarely used paths, but generates more false positives.

DAST (Black-box): Tests the running application, finds runtime issues, but has limited coverage.

Best approach: Combining SAST + DAST + SCA = comprehensive security testing.

Implementation Guide

Phase 1: Tool Selection

Choose a SAST tool based on:

Supported programming languages
Integration with your CI/CD tools
Licensing costs (open source vs commercial)
False positive rate (trial test on your codebase)

Phase 2: Pilot Project

Start with a single project or team:

Run a baseline scan
Resolve critical and high severity issues
Set up quality gates
Measure metrics (number of findings, time to fix)

Phase 3: Scaling

Expand across the organization:

Establish a central security team for triage
Define SLAs for remediation (e.g., Critical: 7 days, High: 30 days)
Integrate with your ticketing system (Jira)
Regular reporting for management

Phase 4: Optimization

Continuous improvement:

Rule tuning to reduce false positives
Create custom rules
Developer training on secure coding
Automate remediation using auto-fix features

Sources

MITRE: 2025 CWE Top 25 Most Dangerous Software Weaknesses (December 2025)
OWASP: Source Code Analysis Tools (October 2026)
NIST: SP 800-218, Secure Software Development Framework (SSDF) 1.1 (February 2022)
Semgrep Docs: CLI reference (October 2026)
GitLab Docs: Security scanner integration (October 2026)
GitHub: github/codeql-action releases (v4.39.0) (October 2026)
GitHub: actions/checkout releases (v7.0.1) (July 2026)
GitHub Docs: Workflow configuration options for code scanning (October 2026)
GitHub Docs: About GitHub Advanced Security (October 2026)
Sonar Docs: SonarQube Community Build, Languages overview (October 2026)
Snyk Docs: Fix code vulnerabilities automatically (October 2026)
Checkmarx: Checkmarx SAST (October 2026)