SAST (static analysis)
SAST · static application security testing · static analysis · source code analysis · automated code review · white-box testing · analyse statique
Automated analysis of an application’s source code, without running it, to find security flaws before the code reaches production.
In practice
The tool reads the code and follows the flow of data to flag, for example, an SQL query built from user input, an obsolete cryptographic algorithm or a hard-coded password. Plugged into the developer’s editor and the CI/CD pipeline, it allows fixes at the moment the code is written, when they cost least. Its limits: false positives that need triage, and a blind spot for anything that depends on runtime (configuration, how authentication actually behaves). That is why it is combined with DAST and SCA.
Fictional case: in a merge request, static analysis flags that a URL parameter goes straight into an SQL query. The developer switches to a parameterised query before the code review even starts: the flaw never reaches production.
How to protect yourself
- Run the analysis on every merge request, not once a year.
- Block only on critical findings at first, then tighten gradually.
- Tune the rules to limit false positives and keep developers’ trust.
