thinQmaster Virtual testing partner Adaptive practice exams that find your weak spots and drill them. Every answer explained. From $69
Enroll

thinQmaster

Find your exam

Five questions free, before you decide.

Step 1 · choose a vendor

In one of our camps? Your practice exams come with the tuition — they are on your study page already.

DevOps & Automation · Intermediate

Static Application Security Testing (SAST)

Analyzing source code, bytecode, or binaries for security vulnerabilities without executing the application.

Definition

SAST runs early in the pipeline and finds issues such as injection flaws, hard-coded secrets, and unsafe functions, pointing to exact lines. Examples include CodeQL, SonarQube, Semgrep, and Checkmarx. It can produce false positives.

Example

CodeQL code scanning flags an SQL query built with string concatenation in a pull request.

Exam tip

SAST = white-box, no running app, early; DAST = black-box, running app, later.

Don't confuse it with

Related terms