Static Application Security Testing (SAST)
- •
def
- •
analyzing an application's source code (without running it) to identify security flaws, such as buffer overflows or database injection vulnerabilities
- •
- •
limitation
- •
can't identify everything (e.g., authentication weaknesses, insecure cryptography) — findings still need to be manually verified, since false positives are common
- •
- •
related
- •