SAST
Static Application Security Testing — a method of analyzing source code for security vulnerabilities without executing the program.
التعريف
SAST tools scan source code, bytecode, or binaries to identify security flaws like SQL injection, cross-site scripting (XSS), buffer overflows, and hardcoded credentials. Unlike DAST (which tests running applications), SAST can find vulnerabilities early in development before code is deployed. Popular SAST tools include Checkmarx, Fortify, Semgrep, and SonarQube.
لماذا هو مهم
SAST enables "shift left" security — finding vulnerabilities when they're cheapest to fix. Gartner reports that SAST can detect up to 50% of vulnerabilities before runtime. It's required by compliance standards like PCI DSS, SOC 2, and HIPAA for organizations handling sensitive data.
مثال
A SAST tool analyzes a login function and detects that user input is concatenated directly into a SQL query, flagging a SQL injection vulnerability before the code reaches production.