Static Application Security Testing (SAST)

Analyze source code and binaries without running the app—fast feedback for developers.

How SAST works

SAST tools parse your codebase (and sometimes bytecode or IR) and apply rules or data-flow analysis to find patterns such as SQL injection sinks, hard-coded secrets, weak randomness, or unsafe deserialization. Because nothing is executed, SAST can run in CI on every pull request.

Source files Parser / AST Rules engine Findings (line:col)

When to use it in the pipeline

On every PR to main/release branches (incremental scan).
Nightly full scan for deep inter-procedural analysis that is too slow for per-commit.
Before release as a gate for critical categories (e.g., injection, authZ bypass patterns).

Tip

Tune severity and suppressions with security team review—noise kills adoption.

Typical features

Feature	Why it matters
IDE integration	Fix before push
SARIF output	Unified ingestion in GitHub/GitLab/Azure DevOps
Custom rules	Encode org-specific dangerous APIs
Baseline / diff	Block only new issues on legacy codebases
Secret detection	Often bundled or paired with dedicated secret scanners

Popular tools

Tool	Notes
Semgrep	Fast, rule-as-code; strong for polyglot monorepos
SonarQube / SonarCloud	Security + quality; quality gates in CI
Checkmarx	Enterprise SAST; deep analysis options
Micro Focus Fortify	Enterprise; audit-heavy environments

Pros

Shift-left: cheapest time to fix
Full codebase coverage path (not route-dependent)
Great for enforcing secure API usage

Cons

False positives without tuning
Misses runtime/config issues (e.g., IAM, headers)
Cannot see deployed behavior or multi-service flows

Example: GitHub Actions workflow snippet

name: sast
on:
  pull_request:
    branches: [ main ]

jobs:
  semgrep:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: |
          docker run --rm -v "$PWD:/src" returntocorp/semgrep semgrep scan \
            --config auto --error --sarif --output semgrep.sarif /src
      - uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: semgrep.sarif

Illustrative only—pin versions and align with your org’s approved scanners.