SAST: What is Static Code Analysis
SAST (Static Application Security Testing) is an analysis technique that examines source code without executing it, looking for patterns that indicate security vulnerabilities. Unlike dynamic testing that requires a running application, SAST operates directly on the code, allowing problems to be identified in the earliest stages of development.
SAST analyzes code looking for vulnerabilities such as SQL injection, cross-site scripting (XSS), buffer overflow, hardcoded credentials, insecure deserialization, and many others. SAST tools build a model of the code (AST - Abstract Syntax Tree) and apply security rules to identify problematic patterns.
In this article, we will explore the main SAST tools, their integration into CI/CD pipelines, and strategies for managing one of the most common problems: false positives.
What You'll Learn
- How SAST works and the difference with DAST and IAST
- Configuring SonarQube, Semgrep, and CodeQL in the CI/CD pipeline
- Writing custom rules for Semgrep
- Managing false positives and prioritizing findings
- Integrating SAST in the IDE for immediate feedback
- Quality Gates and blocking thresholds for deployment
SAST vs DAST vs IAST: The Differences
To choose the right tools, it's essential to understand the differences between the three main security testing approaches:
Security Testing Approaches Comparison
| Feature | SAST | DAST | IAST |
|---|---|---|---|
| Analysis | Source code (white-box) | Running application (black-box) | Runtime with agent (grey-box) |
| When | During development, in CI | In staging/pre-production | During functional tests |
| Coverage | All code, even unreachable | Only HTTP-reachable parts | Code executed during tests |
| False Positives | Medium-high | Low | Very low |
| Speed | Fast (minutes) | Slow (hours) | Depends on tests |
The optimal approach is to use all three complementarily: SAST for quick feedback during development, DAST to validate runtime security, and IAST for precise correlation during testing.
SonarQube: Complete Code Quality Analysis
SonarQube is the most widely used SAST platform, used by over 400,000 organizations. Beyond security, it analyzes code quality, code smells, duplications, and test coverage. The Community edition is open source and covers 30+ programming languages.
Setup with Docker Compose
The quickest way to start SonarQube locally or in a staging environment is through Docker Compose:
# docker-compose.sonarqube.yml
version: "3.8"
services:
sonarqube:
image: sonarqube:lts-community
container_name: sonarqube
ports:
- "9000:9000"
environment:
- SONAR_JDBC_URL=jdbc:postgresql://db:5432/sonarqube
- SONAR_JDBC_USERNAME=sonar
- SONAR_JDBC_PASSWORD=sonar_password
volumes:
- sonarqube_data:/opt/sonarqube/data
- sonarqube_logs:/opt/sonarqube/logs
- sonarqube_extensions:/opt/sonarqube/extensions
depends_on:
- db
db:
image: postgres:15
container_name: sonarqube-db
environment:
- POSTGRES_USER=sonar
- POSTGRES_PASSWORD=sonar_password
- POSTGRES_DB=sonarqube
volumes:
- postgresql_data:/var/lib/postgresql/data
volumes:
sonarqube_data:
sonarqube_logs:
sonarqube_extensions:
postgresql_data:
Integration in GitHub Actions
Integrating SonarQube in the CI/CD pipeline with GitHub Actions allows automatic analysis on every push or pull request:
# .github/workflows/sonarqube.yml
name: SonarQube Analysis
on:
push:
branches: [main, develop]
pull_request:
branches: [main]
jobs:
sonarqube:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0
- name: SonarQube Scan
uses: SonarSource/sonarqube-scan-action@v3
env:
SONAR_TOKEN: