Static Application Security Testing (SAST) is a way to find security vulnerabilities by analyzing source code without actually running it. Think of it like a spell checker for security. It looks for patterns that are known to cause problems.
SAST tools examine code for issues like SQL injection (where user input ends up in database queries), cross-site scripting (where user input ends up in web pages), hardcoded secrets (where passwords or API keys are stored in source code), and dozens of other vulnerability types catalogued by MITRE's CWE database.
How SAST Fits Into Development
Most teams run SAST as part of their CI/CD pipeline. When a developer opens a pull request, the SAST tool scans the changed code and reports any findings. Ideally, issues get caught and fixed before code is merged.
The reality is often messier. SAST tools are notorious for false positives, flagging code that looks suspicious but isn't actually vulnerable. After getting burned by too many false alarms, developers start ignoring findings, which defeats the purpose.
The tools also run after code is written, which means they create work rather than prevent it. A developer finishes a feature, feels good about it, then gets a SAST report with twenty findings to investigate. This is where friction builds up between security and engineering teams.
SAST in the AI Coding Era
The rise of AI coding has made SAST both more important and more challenging. More important because AI-generated code can contain vulnerabilities just like human-written code. More challenging because the volume of code being generated is outpacing the capacity to review SAST findings.
This is part of why approaches like ACSM have emerged. Rather than scanning code after it's written and creating a backlog of findings, ACSM focuses on preventing vulnerabilities during the code generation process itself. SAST still has a role, particularly for scanning human-written code and providing comprehensive coverage, but it works best as part of a layered approach that includes generation-time security from tools like Corridor.