Definition
Static application security testing, or SAST, is a method for analyzing application source code, byte code, or binary code to find security vulnerabilities without executing the program. It operates by examining the code's structure and logic, looking for common flaws like buffer overflows, SQL injection, and cross-site scripting. SAST is crucial for identifying and fixing security weaknesses early in the software development lifecycle, reducing the cost and effort of remediation. For instance, a SAST tool might flag an input field that doesn't properly sanitize user data, preventing a potential injection attack. Unlike dynamic application security testing (DAST), which tests running applications, SAST analyzes the code itself before deployment. This technique is frequently covered on certifications like CompTIA Security+, CySA+, and CISSP.