What is a SAST tool?
⚡
Quick Answer
SAST (Static Application Security Testing) analyzes source code, bytecode, or binaries without running them, to find vulnerabilities like injection flaws and insecure patterns early — e.g., SonarQube, Semgrep, Snyk Code.
Detailed Answer
Because it runs on code, SAST fits early in CI and catches issues before deploy, but it cannot see runtime/config problems and can be noisy with false positives. It complements DAST (which tests the running app). Rule tuning and triage are essential to keep it useful rather than ignored.
💡
Interview Tip
Contrast SAST (analyzes code, early, may false-positive) with DAST (tests running app) — they are complementary, not either/or.
sastsecuritystatic-analysis