SAST (Static Application Security Testing)

SAST tools parse code into an intermediate representation (AST, control-flow graph, data-flow graph) and apply rules or taint analysis to detect insecure patterns mapped to CWEs. Because they run without execution, they integrate naturally into IDEs, pre-commit hooks and CI/CD pipelines and can scan code that does not yet ship. SAST is strong at finding deterministic bugs (SQL injection, XSS sinks, hard-coded secrets, weak cryptography) but tends to produce false positives and miss runtime-only issues, so it is usually combined with SCA and DAST. Modern SAST tools include Semgrep, GitHub CodeQL, SonarQube, Checkmarx and Fortify.