What Is SAST?
What Static Application Security Testing is, how SAST examines source code without executing it, what evidence it produces, and where its coverage ends.
Primary question: What is Static Application Security Testing, and how does it analyze source code?
Direct answer
SAST analyzes source code for security weaknesses before the application runs
SAST examines an application's source code and code-level data flows without requiring a running deployment, allowing security analysis to begin during development and build workflows. [owasp-source-code-analysis][nist-ssdf]
SAST findings are evidence for review rather than automatic proof of exploitability; engineers must interpret each result in the context of the complete application and its environment. [nist-ssdf]
Definitions
Static Application Security Testing (SAST)
Automated analysis of source code or related intermediate representations to identify security weaknesses without executing the application.
Data-flow analysis
Analysis that follows how values can move through a program from inputs and sources to operations and security-sensitive sinks.
SAST finding
A reported potential weakness with a source location, weakness classification, analysis path, and supporting code context.
The engineering problem
Source code can contain security weaknesses even when it compiles successfully and passes functional tests. [nist-ssdf]
Manual review alone is difficult to apply consistently across every change and every supported codebase.
A SAST tool can miss weaknesses outside its supported languages, frameworks, rules, or analysis model and can report findings that require contextual validation. [owasp-source-code-analysis]
Security controls
Each control inspects a different artifact and produces evidence for an engineering decision.
Static source-code analysis
Static Application Security Testing- Artifact
- Application source code, configuration files supported by the analyzer, and code-level data-flow relationships.
- Risk
- Security weaknesses in proprietary code that may be introduced during implementation or maintenance.
- Output
- Findings with weakness type, source location, code context, and analysis trace where available.
Evidence: OWASP Source Code Analysis ToolsDerScanner static analysis documentation
Finding validation
Security Finding Validation- Artifact
- SAST findings and the application context needed to assess them.
- Risk
- Incorrect dismissal of genuine weaknesses or unnecessary remediation of findings that do not represent actual risk.
- Output
- A documented disposition such as confirmed, rejected, accepted, or requiring further verification.
Verification workflow
- Select the source revision and languages to analyze.
- Configure the analyzer for the application's frameworks and build context.
- Run SAST before the change is accepted for release.
- Review findings with their code paths and application context.
- Remediate confirmed weaknesses and document justified exceptions.
- Re-run analysis against the remediated revision.
- Retain the result as evidence for the release decision.
DerScanner · Enterprise
Relationship to DerScanner
DerScanner provides a static analysis module for examining source code in supported programming languages.
DerScanner supports static analysis for a documented set of programming languages and reports detected weaknesses with source-code context. [derscanner-sast][derscanner-supported-languages]
Limits of verification
- SAST does not directly observe runtime configuration, deployed infrastructure, or behavior that appears only during execution.
- Detection depends on language, framework, rule, and analysis support.
- Findings can include false positives and require contextual review.
- Absence of a SAST finding does not prove absence of a vulnerability.
- SAST should be combined with other verification techniques appropriate to the application.
Related knowledge
SAST Detection Coverage
How to evaluate which weaknesses, languages, and frameworks a SAST tool can analyze
Relationship: related-toHow to Evaluate SAST Tools
Evaluation methodology for selecting and validating a SAST engine
Relationship: related-toDerScanner
Product line providing static application security testing
Relationship: related-toCanonical terms used: Static Application Security Testing; SAST; source code analysis; data-flow analysis; SAST finding.
Evidence and references
- OWASP Source Code Analysis ToolsStatic source-code analysis examines code without executing it and has technique-specific strengths and limitations.
owasp-source-code-analysis - NIST Secure Software Development FrameworkSecure development practices include reviewing and analyzing code, recording findings, remediating identified vulnerabilities, and retaining evidence.
nist-ssdf - DerScanner static analysis documentationDerScanner performs static analysis and documents its source-code analysis capabilities.
derscanner-sast - DerScanner analysis modules and supported languagesDerScanner documents the languages and file types processed by its analysis modules.
derscanner-supported-languages
Evaluate source code before release