Skip to main content

Static Security Testing (SAST)

🌟 Objective​

To detect security vulnerabilities in source code before the application runs, through automated static analysis, ensuring:

  • Early and continuous feedback to development teams;
  • Traceability between code, findings and security requirements;
  • Automated integration with the development cycle and CI/CD;
  • Risk reduction without impact on productivity.

SAST is the foundation of shift-left validation - it detects flaws without the need to run the application.

🔍 What SAST is​

SAST (Static Application Security Testing) analyses source code or bytecode to identify dangerous patterns, bad practices, logic flaws and potential vulnerabilities - without running the application.

It can be performed by:

  • Language tooling (linters with security rules);
  • Generic scanners (e.g. commercial tools);
  • Configurable semantic engines (e.g. with custom rules).

⚠️ SAST is complementary to dynamic and manual testing - it does not replace runtime validation.

⚙️ How to apply​

  1. Select the appropriate tool per stack (e.g. Node, Java, .NET, Python);
  2. Define minimum acceptance rules and thresholds (e.g. critical flaws block the build);
  3. Run automatically on every pull request and build pipeline;
  4. Emit findings with traceability by line of code and commit;
  5. Maintain a baseline of accepted findings vs new findings;
  6. Document exceptions and justify false positives, with AppSec follow-up.

💡 Suggestion: use tags on findings to associate requirements (e.g. EX-REQ-205 — illustrative identifier; it does not correspond to the Ch. 02 Requirements Catalogue) and mitigations.

✅ Good practices​

  • Run SAST locally (pre-commit) and in the pipeline (CI);
  • Tune rules to reduce false positives and noise;
  • Establish a clear policy of blocking findings by severity;
  • Integrate with the backlog (e.g. Jira, Azure Boards) for triage and management;
  • Validate the coverage of the analysis (e.g. ignored files, exclusions);
  • Reassess configurations with each technological evolution.

📎 Cross-references​

DocumentRelationship with SAST
Chapter 02 - RequirementsValidates EX-REQ-203, EX-REQ-205, EX-REQ-303
Chapter 06 - DevelopmentReinforces secure coding practices
Chapter 07 - Secure CI/CDSee 07-validacoes-seguranca-integradas.md
06-cobertura-e-priorizacao.mdDefines analysis targets and priorities
08-gestao-findings.mdEnsures effective handling of the results
09-feedback-equipa.mdInvolvement of the teams in validation

Illustrative identifiers (EX-…); they do not correspond to the Ch. 02 Requirements Catalogue.

🔒 SAST reduces the cost of fixing vulnerabilities by acting before execution - but it is only effective when configured with judgement, kept up to date and managed together with the developers.