SAST
Static Application Security Testing
A security testing approach that analyzes application source code or related artifacts without running the application.
Plain English
Scan the code for patterns that may indicate security weaknesses before it runs.
In context
SAST tools inspect source code bytecode or binaries against security rules so teams can find certain vulnerabilities earlier in development and trace findings to code locations.
Example
“The pull request runs SAST before the change can merge.”
When you'll hear this
- secure development
- continuous integration
- code review
Common misunderstanding
SAST cannot find every vulnerability and its findings still need context validation and remediation.
Also known as
static application security testingstatic security analysisstatic code security analysis
Commonly used by
Related terms
Often compared with
Updated: 2026-08-31
