# What is Static Application Security Testing (SAST)?

> Static application security testing analyzes software without executing it to identify patterns that may indicate security defects.

- Canonical URL: https://yellowcube.eu/glossary/static-application-security-testing/
- Publisher: Yellow Cube
- Language: en
- Contact: hello@yellowcube.eu

## Content

Depending on the method, it can inspect source code, intermediate representations, bytecode, or compiled binaries. Techniques range from pattern matching to control-flow, data-flow, and taint analysis that traces untrusted data toward sensitive operations.

Because SAST works on the software’s internal representation, findings can often identify a file, function, and line or code path for developers to review. It can run early and repeatedly in an editor, pull request, or build. Its evidence is a model-based claim about code, however — not proof that an attacker can reach and exploit the condition in the deployed system.

### Key points

- **Evidence examined:** First-party code or compiled artifacts, build context, language semantics, and modeled paths between inputs, data transformations, and security-sensitive operations.
- **Typical findings:** Injection paths, unsafe memory operations, weak cryptographic use, hard-coded secrets, insecure APIs, and violations of organization-defined coding rules.
- **Sound operation:** Match analyzers to supported languages and frameworks, preserve reproducible scan settings, validate high-impact findings, and feed confirmed defects into engineering standards.
- **Important limitation:** SAST can produce false positives and false negatives. It commonly lacks deployment configuration, runtime state, external service behavior, and enough business context to identify many authorization or workflow flaws.

### Related terms

[Dynamic application security testing (DAST)](<https://yellowcube.eu/glossary/dynamic-application-security-testing/>) · [Software composition analysis (SCA)](<https://yellowcube.eu/glossary/software-composition-analysis/>) · [Shift-left security](<https://yellowcube.eu/glossary/shift-left-security/>)

### Sources

[OWASP Source Code Analysis Tools](https://owasp.org/www-community/Source_Code_Analysis_Tools) · [NISTIR 8397, Guidelines on Minimum Standards for Developer Verification of Software](https://www.nist.gov/publications/guidelines-minimum-standards-developer-verification-software)

## Attribution and scope

This Markdown representation is generated from the same approved content records as the canonical HTML page. Cite the canonical URL above when referencing this material. Product and service descriptions are informational; confirm project-specific requirements with Yellow Cube.