Static and dynamic application security testing — find vulnerabilities in code and running applications.
Five passes over the same idea, each from a different angle. Do them in order, or jump to whichever you need.
SAST analyzes source code for vulnerabilities without executing it (CodeQL, Semgrep, SonarQube). DAST tests running applications by sending crafted requests (OWASP ZAP, Burp Suite). IAST combines both approaches at runtime. Integrating both into CI/CD creates a shift-left security posture that catches issues before production.
