Static application security testing (SAST) is software that reads a program's source code, without running it, and reports the lines that could become security flaws. "Static" means that the code is examined as text, not while it runs. SAST tools are also called static analysers or code scanners.
Here is a typical case. A developer at a bus-ticket booking app in Hyderabad writes a new search feature. To save time, he types the database password straight into the code. He also builds the database query by joining the customer's search text into it. He then opens a pull request. The CI/CD pipeline runs the SAST tool on the changed files. About two minutes later, the tool posts two comments on the pull request.
The first comment is about line 18, the password. A password written into the code is called a hard-coded secret. Anyone who can read the code repository can now read the password, and so can anyone who steals a copy of the code. The fix is to keep the password in secrets management software, from which the program fetches it when it starts.
The second comment is about line 42, the query. The customer's search text reaches the database without being checked. So a customer could type a piece of database command instead of a city name, and read other customers' bookings. This attack is called SQL injection. To find it, the SAST tool follows the search text from the place where it enters the program to the place where it is used. This method is called taint analysis. The fix is a parameterised query, which keeps the customer's text separate from the database command.
SAST has one well-known weakness: false positives, which are warnings about code that is actually safe. Developers soon ignore a tool that raises too many of them. So teams tune the rules, and send the findings to application security posture management (ASPM), which ranks them together with the findings of other scanners.
SAST reads only the company's own code. The open-source libraries that the code imports are checked by software composition analysis (SCA). SAST also never runs the app. Testing a running app by attacking it is called dynamic testing, or DAST, and it is covered under penetration testing and DAST. Running SAST on every pull request, instead of once before a release, is an example of shift left security. The same kind of analysis, with stricter coding rules, checks the software in cars and aircraft. That is static analysis for safety-critical code.