SAST (static application security testing)
A security scanner that reads your code without running the app, catching risky patterns while they are still in a pull request.
See it
What it is
SAST reads source code, bytecode, or an intermediate representation and looks for patterns that can become vulnerabilities without starting the application. A simple rule might catch a hardcoded secret; a deeper data-flow rule follows untrusted input into a SQL query or shell command. Semgrep and CodeQL are common examples.
Run it on pull requests, while the author still remembers the code and a fix is cheap. Keep a small ruleset matched to the languages and frameworks you actually use, and promote confirmed findings into blocking checks instead of making every warning fail the build on day one.
The gotcha is context. A scanner can see a suspicious call but may not know that validation happened in middleware, or it may miss a custom wrapper unless you teach it the data flow. SAST also cannot prove how a deployed reverse proxy, identity provider, or cloud permission behaves. Triage the path, tune noisy rules, and pair it with DAST and human review.
Ask AI for it
Add SAST to this repository with Semgrep and CodeQL. Detect the languages and frameworks in use, configure Semgrep's p/owasp-top-ten rules plus focused rules for this stack, and add the matching GitHub CodeQL workflow. Run both on pull requests, export findings as SARIF, and upload the SARIF to GitHub code scanning. Baseline existing findings without hiding them, fail new high-confidence high-severity findings, and document each ignored rule with a code-specific reason and expiry date. Run the scans now, trace each result from source to sink, remove false positives, and fix every confirmed finding with a regression test.