Using SAST to scan your source code for vulnerabilities

Let’s start our survey of scanners with SAST. We encourage you to read this section carefully, even if you don’t intend to use SAST, because many of the principles and practices involved with using SAST carry over to the other scanners as well. Understanding how to use SAST gives you a huge head start in terms of enabling, configuring, and reading the findings of other scanners.

Understanding SAST

SAST looks at your project’s source code, as opposed to interacting with your code as it runs. Sometimes, this approach is referred to as white-box scanning, meaning that the scanner looks inside your app to inspect its code instead of staying outside the app and simply analyzing its behavior.

This scanner looks for bad coding practices, anti-patterns, or the hallmarks of poorly designed or structured code, which are sometimes referred to as code smells, that could potentially result in exploitable security...