Azure Learning

static-analysis

Properties2
tagsdevops, security, sast, code-analysis
aliasesSAST, static application security testing, source code analysis, static code analysis

2 min read

Static Analysis (SAST)

What it is

Static Application Security Testing (SAST), or simply static analysis, analyzes source code (or binaries) without executing it. It inspects the code itself — logic, syntax, and known insecure patterns — to find bugs and vulnerabilities in what you wrote.

Why it exists

Many defects are cheaper to catch by reading the code than by running it: typos, logic errors, unreachable code, unsafe function usage, SQL-injection-prone string concatenation, and hardcoded secrets. Running analysis on every commit gives instant feedback to developers and catches issues in the part of the pipeline where they cost the least to fix.

Key ideas

  • White-box — it has access to the source and reasons over the actual code, so it can find issues DAST cannot.
  • Runs without executing — no environment, no runtime state, no side effects; fast enough to run per commit/PR.
  • Finds “written-code” issues — bug patterns, code smells, style, and security anti-patterns (at the code level).
  • Integrates into the pipeline — runs as a build/PR check; results feed a compliance gate that can fail the build.
  • Limits — it cannot see runtime behavior, configuration, or interactions between live components (that’s DAST’s job).

Example tools

Authored directly in CI/CD for Azure: CodeQL (GitHub), SonarQube/SonarCloud, Pylint (Python), ESLint (JavaScript), Roslyn/.NET analyzers, Credential Scanner for secrets.

How it fits

Part of the shift-left DevSecOps toolkit. SAST = “examine the code”; DAST = “attack the running app”. Both are automated scans that feed a quality/security gate in the DevSecOps pipeline.

Exam notes

  • SAST = static / source / white-box / non-executing — memorized pairing.
  • Best for catching issues during development / code review, on every commit.
  • Complemented by DAST for runtime issues, SCA for dependency issues.
  • Common exam trap: choosing “static” when the question emphasizes running the app (that’s DAST).

dev-sec-ops · dynamic-analysis · software-composition-analysis · compliance-gate · code-signing

📘 Source: Microsoft Learn — Static Analysis

Graph View

Backlinks