[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"glossary-sast::en":3,"gloss-cluster-sast::en":20,"gloss-next-sast::en":9},{"slug":4,"category":5,"name":6,"definition":7,"meta_desc":8,"faq":9,"schema_markup":9,"related":10},"sast","dev-tools","Static Application Security Testing (SAST)","Static Application Security Testing (SAST) is a category of automated security tooling that scans an application's source code for known vulnerability patterns without executing the program — looking for things like SQL injection risks (string-concatenating user input directly into a query), hardcoded secrets and API keys accidentally committed to the repo, insecure use of cryptographic functions, and known-vulnerable dependency versions. Tools include Semgrep, Snyk Code, SonarQube, and GitHub's built-in CodeQL and secret scanning. Why it matters for AI\u002FSaaS builders: security vulnerabilities are dramatically cheaper to catch before code ever reaches production, and SAST tools are one of the few security checks that can run automatically and cheaply on every single pull request, giving continuous, scalable coverage that manual security review can't match at the pace teams ship. This matters especially for teams leaning heavily on AI-generated code, since an LLM can generate code that looks correct but reproduces an insecure pattern it learned from training data (a classic example: string-concatenated SQL, or an authorization check that's present in the happy path but missing on an edge case) — a SAST scanner catches these mechanically, as an objective backstop that doesn't rely on a human reviewer happening to notice. How it works: a SAST tool parses source code into an abstract syntax tree (similar to a linter) and pattern-matches against a rules database of known-insecure code patterns, flagging file\u002Fline locations with a severity rating and often a suggested fix. Unlike dynamic security testing (which requires a running application and tests actual behavior), SAST works purely on source, which means it can run extremely early — in the editor, in a pre-commit hook, and definitely in CI — and it can catch some categories of bug (hardcoded secrets, for instance) that dynamic testing would never trigger. Worked example: a developer writes `db.query(\"SELECT * FROM users WHERE email = '\" + userInput + \"'\")` to look up a user by email. A SAST scanner running in CI immediately flags this as a critical SQL injection vulnerability — a malicious `userInput` value like `' OR '1'='1` would return every row in the table — and blocks the pull request from merging until fixed. The developer rewrites it using a parameterized query, `db.query(\"SELECT * FROM users WHERE email = $1\", [userInput])`, the scanner re-runs and passes, and the vulnerability never reaches a deployed environment where it could actually be exploited.","SAST scans source code for known security vulnerability patterns — like SQL injection or hardcoded secrets — without running the program.",null,[11,14,17],{"slug":12,"name":13},"ci-cd","Continuous Integration \u002F Continuous Deployment (CI\u002FCD)",{"slug":15,"name":16},"code-review","Code Review",{"slug":18,"name":19},"linter","Linter",[21,25,28,32,35,38,41,44,47,48,51,54],{"slug":22,"category":5,"name":23,"updated_at":24},"agent","Agent","2026-08-24T02:46:36+00:00",{"slug":26,"category":5,"name":27,"updated_at":24},"ai-code-assistant","AI Coding Assistant",{"slug":29,"category":5,"name":30,"updated_at":31},"api-gateway","API Gateway","2026-08-24T02:46:37+00:00",{"slug":33,"category":5,"name":34,"updated_at":31},"api-versioning","API Versioning",{"slug":36,"category":5,"name":37,"updated_at":24},"autonomous-agent","Autonomous Agent",{"slug":39,"category":5,"name":40,"updated_at":31},"blue-green-deployment","Blue-Green Deployment",{"slug":42,"category":5,"name":43,"updated_at":31},"canary-deployment","Canary Deployment",{"slug":45,"category":5,"name":46,"updated_at":31},"chaos-engineering","Chaos Engineering",{"slug":12,"category":5,"name":13,"updated_at":24},{"slug":49,"category":5,"name":50,"updated_at":31},"circuit-breaker","Circuit Breaker",{"slug":52,"category":5,"name":53,"updated_at":31},"cli","Command-Line Interface (CLI)",{"slug":55,"category":5,"name":56,"updated_at":31},"cloud-development-environment","Cloud Development Environment (CDE)"]