Static Application Security Testing (SAST)

Static Application Security Testing (SAST) analyzes source code to find security vulnerabilities without executing the application. Unlike dynamic testing that requires a running application, SAST can catch issues early in development—when they're cheapest to fix.

SAST tools scan your codebase for patterns that indicate security weaknesses: SQL injection, cross-site scripting, hardcoded secrets, insecure cryptography, and hundreds of other vulnerability classes. They integrate into your IDE, CI/CD pipeline, and code review process to provide continuous security feedback.

This guide covers three of the most popular SAST tools, each with different strengths:

• SonarQube — Comprehensive code quality and security platform
• Semgrep — Fast, customizable pattern matching for security rules
• CodeQL — Powerful semantic code analysis from GitHub

What You'll Learn

This guide consists of the following parts:

1. SAST Fundamentals - How static analysis works, types of analysis, limitations
2. SonarQube - Setup, configuration, quality gates, and CI/CD integration
3. Semgrep - Writing custom rules, registry usage, and pipeline integration
4. CodeQL - Query language basics, security queries, and GitHub integration

Why SAST Matters for DevOps

Consider these scenarios:

• A SQL injection vulnerability ships to production because no one noticed the string concatenation
• Hardcoded AWS credentials in a config file get committed and exposed
• A junior developer uses MD5 for password hashing, unaware it's insecure
• An open redirect vulnerability sits in the codebase for months before discovery

SAST tools catch these issues automatically during development, not after deployment. They provide a safety net that scales with your team—every commit gets the same thorough security review.

Prerequisites

This guide assumes you have:

• Basic understanding of common vulnerabilities (SQL injection, XSS, etc.)
• Familiarity with CI/CD pipelines (GitHub Actions, GitLab CI, Jenkins)
• Experience with at least one programming language
• Docker installed (for running SonarQube locally)

Who This Guide Is For

This guide is designed for:

• DevOps engineers implementing security in CI/CD pipelines
• Security engineers evaluating or deploying SAST tools
• Developers wanting to catch security issues earlier
• Teams building a DevSecOps practice from scratch

Let's start finding vulnerabilities before attackers do!