Static application security testing (SAST) examines application code and related artifacts without running the application, looking for common security flaws, vulnerabilities, and misconfiguration errors. section 1.5
Run SAST during implementation and connect it to CI/CD so insecure code can be identified before release. It complements unit, integration, fuzz, and API security testing rather than replacing them. section 1.5
A practical security workflow places SAST alongside:
- Secure implementation practices such as validating and sanitizing data, parameterizing database queries, and using secure data-handling patterns. section 1.5
- Software composition analysis (SCA), which checks third-party dependencies for known CVEs rather than examining application code for common flaws. section 1.5
- Tools such as Snyk, Semgrep, Aikido, and Checkmarx. section 1.5
Figure 1.6 Security by design fits into every step of the API development cycle. It encourages us to approach design, implementation, testing, and operations from a security point of view.
Use the API development-cycle figure to place SAST within security-minded design, implementation, testing, and operations. section 1.5
