Testing methods
SAST
Static Application Security Testing
Static Application Security Testing (SAST) inspects source code, bytecode, or binaries for insecure patterns without executing the program. It integrates early in development and can pinpoint the exact line of a flaw, but it has no runtime context, so it produces false positives and cannot confirm exploitability the way dynamic or autonomous testing can.
Key points
- White-box: requires access to source or compiled code.
- Runs early (shift-left) and locates issues at the line level.
- No runtime context, so exploitability must be confirmed separately.
- Pairs with DAST and autonomous testing for validated findings.
FAQ
Does SAST confirm a vulnerability is exploitable?
No. SAST flags suspicious code patterns but has no runtime context, so many findings are not actually exploitable. Confirming exploitability requires dynamic, interactive, or autonomous testing that exercises the running app.
Related
References
Impactr finds and proves whether flaws like this are actually reachable in your own web apps and APIs, with a reproducible exploit as evidence.