# Sast

> SAST (Static Application Security Testing)

- Skill: `neuralblitz/sast` (Agent Skill)
- Install (CLI): `npx skillmds@latest add neuralblitz/sast`
- Raw SKILL.md: https://api.skillmd.com/api/skills/neuralblitz/sast/raw
- Safety review: pending (external: skill-scanner PASS, skillspector PASS)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: AI & ML
- Author: NeuralBlitz (https://skillmd.com/u/neuralblitz)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/neuralblitz/sast

---

# SAST (Static Application Security Testing)

SAST is an application security testing methodology that analyzes source code, bytecode, or binaries without executing the application. It identifies vulnerabilities early in the development lifecycle.

## Key Concepts

- Source code analysis
- Taint tracking
- Data flow analysis
- Pattern matching rules
- CI/CD integration

## Common Use Cases

- Pre-commit scanning
- PR security checks
- Compliance requirements
- Security gates
- Vulnerability prioritization

## Best Practices

- Integrate into CI/CD pipeline
- Tune rules to reduce noise
- Prioritize findings by severity
- Track remediation time
- Combine with DAST

## Resources

- OWASP: owasp.org/www-community/Source_Code_Analysis_Tools
- Tools: Semgrep, CodeQL, SonarQube
- Related Skills: secure-coding, devsecops, dast