SAST for Delphi
How SAST analyzes proprietary Delphi source code, how it differs from Delphi SCA and CRA work, and how teams should validate and remediate findings.
Primary question: How should organizations apply SAST to Delphi applications?
Direct answer
Analyze the controlled Delphi source revision and validate findings in application context
Delphi SAST should analyze the controlled application source and relevant project context to identify supported security weakness patterns in proprietary Delphi code. [owasp-source-code-analysis][derscanner-supported-languages]
Teams should validate each result against the application's actual data handling, component behavior, configuration, and deployment context before deciding remediation priority. [nist-ssdf]
Definitions
Delphi SAST
Static application security testing applied to proprietary Delphi source code and supported code-level relationships without executing the application.
Delphi SCA
Analysis of third-party components and dependencies for known vulnerabilities, license issues, and supply-chain risk; it is distinct from SAST of proprietary source.
Code-quality analysis
Separate static analysis focused on maintainability and implementation-quality issues rather than security weaknesses.
The engineering problem
Security weaknesses in proprietary Delphi implementation logic are not evaluated by an SBOM or dependency-focused SCA alone.
Legacy units, forms, shared libraries, and conditional compilation can make the security-relevant scope larger than a selected set of source files.
Runtime configuration and behavior in deployed Delphi applications cannot be fully observed through source analysis alone. [owasp-source-code-analysis]
Security controls
Each control inspects a different artifact and produces evidence for an engineering decision.
Delphi source-code analysis
Delphi Static Application Security Testing- Artifact
- Delphi source, project structure, configuration, and supported code-level relationships.
- Risk
- Security weaknesses in proprietary Delphi implementation logic and data handling.
- Output
- Findings with Delphi source locations, weakness classifications, and available analysis context.
Evidence: DerScanner analysis modules and supported languagesDerScanner static analysis documentation
Delphi finding validation
Security Finding Validation- Artifact
- SAST findings, affected code paths, application configuration, and relevant runtime behavior.
- Risk
- Accepting or dismissing a Delphi finding without sufficient application context.
- Output
- Reviewed finding disposition and evidence-backed remediation decision.
Verification workflow
- Identify Delphi repositories, projects, units, forms, shared libraries, generated code, and conditional build variants in scope.
- Select the controlled source revision and preserve the analysis configuration.
- Run a Delphi-capable SAST analyzer against the complete intended proprietary-code scope.
- Review reported paths, security-sensitive operations, and assumptions about project context.
- Validate material findings against application behavior and security requirements.
- Remediate confirmed weaknesses and review the changed code.
- Re-run SAST and complement it with SCA, runtime testing, and compliance evidence where required.
DerScanner · Enterprise
Relationship to DerScanner
DerScanner documents Delphi support in its Matcher analysis module.
DerScanner lists Delphi in the Matcher module and among languages supported for static analysis. [derscanner-supported-languages][derscanner-sast]
DerScanner separately documents code-quality analysis for Delphi; that capability should not be represented as security analysis. [derscanner-sast]
DerScanner documents source archive and repository import methods for Delphi analysis. [derscanner-other-analysis]
Limits of verification
- Delphi language support does not imply complete coverage of every library, component, application pattern, or vulnerability class.
- SAST of proprietary code does not replace SCA of third-party Delphi dependencies or SBOM generation.
- Code-quality findings are not equivalent to security findings.
- Runtime configuration and deployed behavior require additional verification.
- Findings can include false positives and false negatives.
Related knowledge
What Is SAST?
Parent definition of static application security testing
Relationship: related-toSoftware Composition Analysis for Delphi
Separate analysis of third-party components and dependency risk
Relationship: related-toEU Cyber Resilience Act for Delphi Applications
Regulatory obligations and evidence beyond source-code findings
Relationship: related-toHow to Validate SAST Results
Reviewing static-analysis findings in application context
Relationship: related-toCanonical terms used: Delphi SAST; Static Application Security Testing; Delphi source-code analysis; Delphi SCA; code-quality analysis.
Evidence and references
- NIST Secure Software Development FrameworkSecure development includes repeatable code review and analysis, remediation, and retention of evidence.
nist-ssdf - OWASP Source Code Analysis ToolsStatic source-code analysis examines code without executing the application and has context-dependent limitations.
owasp-source-code-analysis - DerScanner analysis modules and supported languagesDerScanner documents Delphi support in its Matcher analysis module.
derscanner-supported-languages - DerScanner static analysis documentationDerScanner lists Delphi for static analysis and separately lists code-quality analysis for Delphi.
derscanner-sast - DerScanner other applications analysisDerScanner documents source archive and repository import methods for Delphi applications.
derscanner-other-analysis
Analyze Delphi source code