What is SAST?

Last updated: Oct 21, 2026

---

Static application security testing (SAST) is a security testing technique that identifies security vulnerabilities in the source code of an application.

Unlike dynamic application security testing (DAST), which examines the application while it runs, SAST examines the code before compilation or execution. Thus, developers can find and fix vulnerabilities early in the software development lifecycle (SDLC). This decreases the risk of expensive remediation later.

The Fluid Attacks static analysis got a true positive rate of 100% and a false positive rate of 0% in the OWASP Benchmark. This benchmark is a well-known standard to examine security testing tools. Thus, the Fluid Attacks AppSec testing tool identifies real vulnerabilities correctly and does not report false alarms.

To learn more about the Fluid Attacks SAST capabilities, see these resources in this documentation:

• Supported languages: See the programming languages that the static analysis tool supports. Then, you can make sure that the tool is compatible with your development environment and technology stack.
• Supported frameworks: See the frameworks that the static analysis tool supports.
• Security requirements verified with SAST: Learn about the security requirements that Fluid Attacks uses for its SAST scans. This page shows the weaknesses that the tool can detect, their severity, their CWE ID, and more data.
• Use the scanners: Do SAST and other techniques with the Fluid Attacks command-line interface (CLI) tools.
• SAST scanner configuration file: Change the settings of your SAST scans.
• Sign up: Start the free trial of SAST and other Fluid Attacks automated techniques. Fluid Attacks configures the scanner for you. The scanner monitors the security of your system continuously while you develop. Fluid Attacks gives you reports, analytics, and remediation suggestions on its platform.
• AI SAST: Static application security testing that uses AI.