Search for a command to run...
Specialized in uncovering vulnerabilities within software supply chains and dependency ecosystems. Creator of SCAGoat and other open-source security tools. Speaker at Black Hat, DEF CON, and AppSec conferences with research on malicious package detection, dependency confusion, and CI/CD security.
No comments yet. Be the first to comment.
In this series, I will take you on a 30-day journey through the world of Static Application Security Testing (SAST). We'll start from its historical roots and core concepts, dive into tools like Semgrep and CodeQL, and advanced rule writing.
What the Axios malicious package contained, how it was published, and how teams can check GitHub, Intune, CrowdStrike, and Jamf.
As security researchers, we often analyze vulnerabilities in isolation. A Remote Code Execution (RCE) in a web app is one thing; sharepoint compromise in an enterprise cloud is another. But what happens when these two converge? To understand the true...
1. Introduction: The Attack of the Code Worm Imagine building a project with a set of Lego bricks, but one of the bricks is secretly malicious. Not only is it a bad piece, but it also has the ability to copy itself and sneak into all the other Lego s...
Static code analysis has come a long way from the days of simple string searches. With the rising complexity of applications and threats, our tooling has evolved to meet the demand for both precision and context-awareness. This blog takes you through...
In a startling turn of events, the widely-used Nx build system fell victim to a sophisticated supply chain attack. On August 26, 2025, malicious versions of the Nx packages were published to the npm registry, compromising the systems of potentially t...
This is the first article in a 30-day series on Static Application Security Testing (SAST). We’ll introduce what SAST is and why it matters for building secure software. SAST refers to analyzing source code to find security vulnerabilities without executing the program. It’s essentially a “white-box” approach where the code is reviewed (often by automated tools) to catch issues early in development. The value of catching security bugs early is huge – fixing a vulnerability discovered in production can cost 30× more than fixing it during development. By integrating SAST into the software development life cycle (SDLC), teams can “shift left” on security, addressing vulnerabilities in the code phase before they become expensive problems later. Many common weaknesses from the OWASP Top 10 (like SQL injection or XSS) can be identified through static analysis of code, improving code security from the outset.
In this tutorial-style post, we’ll cover what SAST entails, where it fits in the SDLC, how it works under the hood, its benefits and challenges, and how it compares with other testing approaches like DAST and SCA. The goal is to provide a practical foundation for developers and security engineers to start using static analysis in their secure coding and code review practices.
Static Application Security Testing (SAST) is a methodology for finding security bugs in an application’s source code (or compiled code) without running the application. Because the code is analyzed at rest, SAST is considered a white-box testing technique – the tester (or tool) has full visibility into the internal code structure. The main idea is to scan the code to spot patterns that could lead to vulnerabilities (such as misuse of user input, insecure function calls, etc.) before the software is ever executed or deployed. In practice, SAST is usually done with automated tools (static code analyzers) that parse the code and flag potential issues. However, it can also include manual secure code review by humans. The focus is on identifying coding errors or missing security controls that might allow attacks – for example, an input that isn’t validated or sanitized, or the use of an outdated cryptographic function.
One key advantage of SAST is that it doesn’t require a running application or any special environment – you can perform a static scan as soon as code is written or checked into version control. This means SAST can be introduced very early in the development process. In fact, it’s common to integrate SAST checks into the normal development workflow, even as code is being written in the IDE or on each commit to the repository, catching issues before they ever reach a build or runtime environment.
SAST is a quintessential “shift-left” security practice. Traditionally, security testing happened toward the end of the SDLC (for example, via penetration testing or dynamic scans after an application was built). Static analysis flips this by moving security tests to the earliest stages of development. Specifically, SAST is typically performed during the coding and implementation phase of the SDLC, often as part of the coding or commit process. For instance, developers can run SAST tools inside their IDE while writing code (to get instant feedback on security issues), or trigger a static scan on each commit to the code repository to catch vulnerabilities before the code is merged. In contrast, other testing methods like DAST are usually applied later in the lifecycle (during QA or pre-production) once the application is up and running.
In the diagram: During development, developers run SAST tools on the source code. At build time, security checks like Software Composition Analysis (SCA) scan for vulnerable libraries. In test/QA stages, Dynamic Application Security Testing (DAST) probes the running application for flaws. SAST’s placement at the code stage means issues can be fixed long before deployment. By integrating SAST into CI/CD pipelines (for example, failing a build if critical issues are found), teams ensure that insecure code is caught early rather than after the app is built or released. This early integration is critical to preventing costly fixes down the line and helps ingrain security into the development process from the start.
At a high level, SAST tools work by examining the code’s structure and data flows to detect potential vulnerabilities. The tool parses the source code (or bytecode) and looks for patterns or flows that match known insecure coding practices. Key techniques involved include:
Pattern Matching – Some issues can be found with simple pattern rules or linters. For example, a rule might flag any use of a dangerous function like exec() or detect hard-coded passwords in the code.
Data Flow (Taint) Analysis – More advanced SAST engines perform taint analysis, which tracks how data moves through the program. The idea is to identify “sources” of untrusted input (e.g. user-provided data from web requests) and see if they reach “sinks” (security-critical functions like database queries, file writes, OS commands, etc.) without proper sanitization or validation. If tainted data flows into a sink, it’s flagged as a potential vulnerability.
For example, consider a snippet of code that builds an SQL query from user input in a Node.js application:
// Vulnerable example:
const userId = req.query.id;
const query = `SELECT * FROM users WHERE id = ${userId}`;
db.execute(query);
Here, userId comes directly from an HTTP request (req.query.id). The code concatenates it into an SQL query without any validation or parameterization. A SAST tool would likely flag this code as a SQL Injection risk, warning that an attacker could inject SQL commands via the id parameter. The analyzer recognizes a data flow from an external input source into a database query sink.
When a static analysis tool runs, it outputs a list of findings – each usually includes:
File/Location – where the issue is in the code (file name and line number).
Issue Description – what the potential problem is (e.g. “SQL Injection: unsanitized input flows into a SQL query”).
Severity – how critical the issue is (e.g. High, Medium, Low).
Remediation Guidance – tips or links on how to fix the issue (for example, “Use parameterized queries or an ORM to avoid SQL injection.”).
For instance, the tool in the above example might produce a warning pointing to the line with the SQL query and suggest using parameterized queries or stored procedures to prevent injection. The output is often developer-friendly: many SAST tools highlight the exact code snippet and trace the vulnerable data flow, so you can see how data went from source to sink in your code.
Modern static analysis tools can handle large codebases quickly. They often provide useful context for each finding (some even generate graphical call graphs or traces for easier navigation). Many tools also integrate with development workflows – for example, as IDE plugins that underline risky code in real time, or as part of automated CI pipelines that generate reports or annotations in pull requests. The result of SAST is not a guarantee of a 100% secure application (manual review and other testing are still needed for coverage), but it is an efficient way to catch a wide range of common vulnerabilities early. Developers can then fix those issues long before the application goes live.
Incorporating static analysis into your development process brings several benefits:
Early Vulnerability Detection (Shift-Left) – SAST scans code early in the SDLC, allowing developers to find and fix security issues in the initial stages of development. Fixing problems early prevents costly rework later and reduces the chance of serious vulnerabilities escaping into production. It also means security isn’t just an afterthought at the end of a release – it’s built in from the start.
Comprehensive Code Coverage – Automated static analysis can review 100% of the codebase, something that is impractical with manual code reviews. Tools can scan millions of lines of code in minutes, far faster than a human. This ensures that no part of the application (even the rarely-used modules) goes unchecked. By scanning everything, SAST can catch obscure issues that a manual review might overlook due to time constraints.
Detects Common Weaknesses – SAST excels at catching well-known vulnerability patterns. It can automatically identify issues like buffer overflows, SQL injection, cross-site scripting (XSS), hard-coded credentials, insecure use of APIs, and many other common flaws. These correspond to many OWASP Top 10 risks and CWE categories. Having a SAST tool in place is like having an expert reviewer constantly watching for these classic mistakes and alerting you immediately when they are introduced.
Improves Code Quality and Consistency – Static analysis doesn’t just find security bugs; it often helps enforce good coding practices overall. The feedback from SAST tools (e.g. “validate input here,” “close this database connection,” “catch this exception”) can lead to more robust and maintainable code. Over time, developers learn from these alerts and start writing more secure code by habit. In this way, SAST acts as a teaching tool, raising the security skill floor of the development team.
Seamless Integration with Development Workflow – Modern SAST solutions can integrate into the developer’s workflow, which greatly streamlines adoption. For example, you can install a SAST plugin in your IDE to get instant feedback as you write code (like a spell-checker for security). Also, SAST can be embedded in CI/CD pipelines – for instance, as a build step that fails the build if high-severity issues are found. This automation ensures that insecure code doesn’t slip through code reviews or testing unnoticed. By making the tool part of everyday development and CI processes, teams foster a DevSecOps culture where security checks are as automatic as unit tests.
Compliance and Reporting – For organizations with compliance requirements or security standards (PCI-DSS, OWASP ASVS, etc.), SAST provides a way to enforce secure coding guidelines and produce evidence of due diligence. Many static analysis tools generate detailed reports and dashboards. These can be used to track security debt over time, demonstrate compliance (e.g. “we scan every build and address critical findings”), and focus remediation efforts on the highest-risk issues first. The reporting features also make it easier to communicate security status to management and auditors.
Overall, using SAST leads to finding and fixing vulnerabilities much earlier in the development cycle than traditional testing. It improves software security and quality, and can save significant time and cost by preventing late-stage surprises.
No security approach is without its challenges, and SAST is no exception. When implementing static analysis, be aware of the following:
False Positives – One of the biggest pain points of SAST is noise from false positives (alerts about code that is not actually vulnerable). Static analysis works on heuristics and patterns, so it can sometimes flag code that technically matches a risky pattern but isn’t exploitable in reality. High rates of false positives can overwhelm developers and lead them to start ignoring the tool’s output. In fact, too many false alarms can cause people to miss real issues. Tuning the tool is essential – for example, disabling irrelevant rules or adding exceptions – to ensure the findings are relevant. Careful calibration can bring false positives down to a manageable level, so that when the tool flags something, it’s likely worth attention.
False Negatives and Gaps – Conversely, static analysis can miss issues (false negatives), especially complex ones. Certain categories of vulnerabilities are difficult for automated tools to detect. For instance, authentication or authorization logic flaws, race conditions, or issues caused by misuse of cryptography might not be recognized by a typical SAST tool. Current SAST tools can automatically identify only a subset of security flaws, so you should not rely on them as your sole security evaluation. They are best used in combination with other methods (like manual code review, threat modeling, and dynamic testing) to cover areas that automation can’t easily check.
Limited Runtime Context – SAST analyzes code in isolation, without a live environment. This means it can’t catch issues that only appear when the application is running. Misconfigurations or deployment-specific security issues are outside the scope of static code analysis. For example, a dangerous default configuration in a framework, an insecure server setting, or an issue with how components interact at runtime would not be visible in a static scan. Those types of problems are usually caught by dynamic testing or configuration reviews. It’s important to know the limits of SAST’s view – it looks at the code as written, but not how it behaves with real data in a real environment.
Analyzing Incomplete or Generated Code – SAST works best on a complete, buildable codebase. If you try to scan incomplete code (say, just a partial module) or code that you can’t compile/resolve (due to missing dependencies, generated code, etc.), the tool may struggle. Many SAST tools have difficulty analyzing code that can’t be compiled or fully resolved – they might throw errors or produce lots of false positives in such cases. For example, if your project requires certain libraries or frameworks, the scanner needs access to those to understand your code. Ensuring that the analysis environment is properly configured (with all the necessary code, stubs for APIs, etc.) is necessary for accurate results.
Result Triage and Developer Training – A static scan can output a large list of findings, especially on a first run against legacy code. Not all findings are equal – some will be high-risk true vulnerabilities, others might be minor issues or false positives. Teams need a process (and dedicated time) to triage the results: filtering out false positives and deciding which real issues to fix first. This triage step requires security expertise to review and confirm issues. Additionally, developers may need guidance to understand certain vulnerabilities and how to fix them properly. Without proper training and process, there’s a risk that SAST findings get ignored or create friction. It’s important to cultivate a collaborative approach where developers and security folks work together to interpret and address the tool’s output.
Tooling and Integration Overhead – Adopting SAST isn’t just a plug-and-play affair. There is an initial overhead in selecting the right tool, configuring it, and integrating it into your build or IDE. Different tools support different languages and frameworks – you have to ensure the tool you choose fits your tech stack and your team’s workflow. Integration into CI/CD can also introduce some performance overhead (scans take time) and maintenance effort (updating rules, managing tool updates). Commercial SAST tools can be expensive (though many offer enterprise features), whereas open-source tools may require more DIY integration effort. Key considerations include ease of setup, CI integration capabilities, and how results will be consumed by developers. It’s wise to start with a pilot project to fine-tune these aspects before rolling out SAST broadly.
Despite these challenges, most of them can be managed with the right strategy – for example, by tuning rulesets, supplementing SAST with other testing methods, and providing training on secure coding. The benefits of catching bugs early usually far outweigh the drawbacks, especially as teams learn to handle the tool’s output effectively.
To put SAST in context, it helps to compare it with other application security testing approaches:
SAST (Static Application Security Testing) – White-box testing that scans the application from the inside out by reviewing its source code (or compiled code) for vulnerabilities. SAST is done early in the development cycle (it can run on uncompiled code, even on each save or commit) and finds issues by analyzing the code’s structure and logic. It’s great for catching coding bugs (like the use of dangerous functions, missing input validation, etc.) before the app is ever run. SAST provides detailed insight into exactly where the problem is in the code. However, because it doesn’t execute the application, it cannot find issues that only manifest at runtime (e.g. misconfigured server settings or runtime environment problems).
DAST (Dynamic Application Security Testing) – Black-box testing that involves scanning a running application for vulnerabilities by simulating attacks from the outside. DAST does not require access to the source code; instead, a DAST tool interacts with the live application (usually in a test/staging environment) – for example, by sending HTTP requests, fuzzing inputs, or crawling the app to find security weaknesses. The goal is to detect vulnerabilities in the running app, such as SQL injection, XSS, authentication or access control issues, etc., by actually attempting to exploit them. Because DAST requires a working application, it typically takes place later in the SDLC (after the software has been built and deployed to a test environment). DAST has the advantage of finding issues that might depend on real configuration or integration (for example, it could catch a misconfigured HTTP header or a logic flaw that only shows up when the whole system is running). It also generally has fewer false positives – if a DAST tool reports a vulnerability, it usually means it was able to actually demonstrate it (e.g. it got a database error by injecting ' OR '1'='1'). On the flip side, DAST might not cover all code paths (it’s limited to what it can exercise through the app’s interfaces), and when it finds an issue, it may not pinpoint the exact line of source code – it just shows the symptoms from outside.
SCA (Software Composition Analysis) – This is a different type of static analysis focused on your application’s dependencies (open-source libraries, frameworks, and other third-party components). SCA tools scan the ingredients of your software (e.g. your package.json, pom.xml, or other dependency manifests) to identify known vulnerabilities in the libraries you’re using. Essentially, it checks if any of your components have known CVEs against them. SCA is crucial given the prevalence of open-source – a vulnerability in a popular library (like those in Log4j, OpenSSL, etc.) can affect your app even if your own code is secure. SCA usually runs during the build or whenever new packages are added, and can alert you if, say, a newly introduced dependency has a critical security flaw. It often goes hand-in-hand with SAST and DAST by covering the supply chain aspect of application security (it’s sometimes called component analysis). Note that SCA won’t find logical bugs in your code; it’s specifically checking for known issues in third-party components (and sometimes also license compliance issues).
Each of these methods has a unique focus, and they complement each other. SAST shines at finding bugs in your code early in development; DAST finds issues that appear when the whole application is running; SCA finds risks in the code you didn’t write but have included. In real-world AppSec programs, you typically leverage all three approaches to achieve better coverage. No single technique catches everything – for example, if you relied only on SAST, you might miss a configuration mistake that a DAST scan would catch, and if you relied only on DAST, you’d likely miss many internal code flaws that can be detected via static analysis. By using multiple testing methods (plus practices like code review and penetration testing), organizations build a defense-in-depth strategy where each layer backs up the others.
SAST is a powerful technique for improving your code’s security posture from the very start of development. By integrating static analysis into your coding and build process, you can catch many issues long before they become expensive, customer-impacting problems. In this Day 1 post, we covered the fundamentals of what SAST is, how it works, its benefits and challenges, and how it compares to dynamic testing and dependency analysis.
Now it’s time to put some of this knowledge into practice. Here are a few next steps you can take:
Try a SAST tool on a sample project – Pick a small application or piece of code and run a static analysis tool on it. For example, if you write Python, you could use a tool like Bandit (which scans for common Python security issues); for JavaScript/TypeScript, you might try ESLint with security rules or a purpose-built scanner like NodeJsScan; for a variety of languages, an open-source tool like Semgrep is very approachable. The OWASP Source Code Analysis Tools page lists many SAST tools (both open-source and commercial) for different languages – it’s a great resource to find one that fits your tech stack. Try running a scan and see what kinds of findings come up.
Review and fix issues – Take some of the findings from the SAST report and attempt to fix them. This is a learning exercise: for instance, if the tool points out a potential SQL injection in your code, try to remediate it by using prepared statements or proper input validation. By fixing the issue, you’ll deepen your understanding of the vulnerability and how to avoid it in the future. If you encounter false positives (issues that you suspect aren’t real problems), note them and see if the tool allows you to suppress or tune those rules.
Integrate SAST into your workflow – Once you’re comfortable with a SAST tool, consider integrating it into your regular development process. For example, you can add a static analysis step to your CI pipeline (so that every push or pull request gets scanned automatically). Many CI/CD platforms have ready-made integrations or actions for popular SAST tools. You can also set up an IDE plugin to get real-time feedback as you write code. By making the tool part of your workflow, you ensure continuous security feedback. Start in a non-blocking mode (just reporting issues) and over time you can enforce rules (e.g. fail the build on high-severity findings) as the team gains confidence.
Keep learning and stay tuned – There is a lot more to explore in static analysis. In the upcoming posts of this 30-day series, we will dive deeper into SAST tools, cover advanced topics like customizing rules, handling false positives, and combining SAST with other security techniques. We’ll also look at real-world examples and case studies. To build a well-rounded AppSec skillset, you might also want to read up on secure coding practices and even try some dynamic testing to contrast with SAST. For now, congratulations on taking the first steps in incorporating static analysis into your security toolkit!
OWASP Source Code Analysis Tools – OWASP’s list of SAST tools and resources. This community-maintained page lists dozens of static analysis tools (with info on language support, license, etc.) and includes tips on strengths/weaknesses of SAST. It’s a great starting point to find a tool for your needs.
OWASP Code Review Guide – Guide for performing secure code reviews. While not specific to automated SAST, this guide (available via OWASP) provides a comprehensive look at how to review code for security issues. It can help you understand what kinds of flaws to look for (and many of those same flaws are what SAST tools detect). This is useful if you are augmenting tool-based analysis with manual reviews.
Synopsys (Black Duck) – “What is SAST?” – Glossary and overview of SAST. A detailed explanation of static application security testing and its importance, provided by Synopsys (makers of Coverity). It covers the problems SAST solves, like finding issues such as buffer overflows, SQL injection, and XSS, and why integrating SAST into the SDLC is beneficial.
Checkmarx Blog – SAST, DAST & SCA in the SDLC – Article on integrating different security tests. This blog post discusses how to incorporate static, dynamic, and software composition analysis into a modern development pipeline, and why a combination of these approaches is recommended. It’s a good read to understand the “big picture” of where SAST fits alongside other security activities.