SAST

Definitions

1. Static Application Security Testing — analyzing source code or compiled binaries for security vulnerabilities without executing the program. Finds issues like SQL injection, XSS, hardcoded secrets, and insecure configurations during development. Tools include Semgrep, SonarQube, CodeQL, and Snyk Code. Complements DAST (dynamic testing).

   In plain English: Automatically scanning your source code for security vulnerabilities before you even run the program.

   Example: "The SAST scan in CI flagged a SQL injection on line 42 — the query concatenates user input instead of using parameterized queries."

Related Terms

• Integration Testing
• Secret Scanning
• Flaky Test
• DAST
• Shift Left
• Supply Chain Security
• Nightly Build
• Matrix Build
• Black Box Testing
• Bug Bounty Program
• Burp Suite
• Dynamic Application Security Testing
• Ethical Hacking
• Fault Injection
• Fuzz Testing
• Gray Box Testing
• Offensive Security
• Visual Regression Test
• Adversary Simulation
• Attack Emulation
• Black Box Fuzzing
• Cloud Penetration Testing
• Dynamic Analysis
• Fuzzer