SAST
In plain terms
Scanning source code for security flaws without running it.
Going deeper
Static Application Security Testing analyzes code, dependencies, and config at rest to flag vulnerabilities early in development. It catches issues before deployment but can produce false positives.
Under the hood
Analyzes code without executing it, catching issues early but prone to false positives; complemented by DAST (runtime) and SCA (dependency scanning).
Examples
SonarQube, Semgrep, CodeQL, Checkmarx, Snyk Code in CI pipelines.
Think of it like...
Like proofreading a contract for risky clauses before anyone signs it, rather than discovering problems in court.