Shift Left Security - SAST, SCA, and Secrets Management

Understand SAST and How It Works

SAST — Static Application Security Testing — analyzes your source code without executing it. It parses the code, builds a model of how data flows through the application, and identifies patterns that match known vulnerability types. ### What SAST Actually Does When you write this code in Java: ```java // Vulnerable — user input goes directly into SQL query String query = "SELECT * FROM users WHERE id = " + request.getParameter("id"); Statement stmt = connection.createStatement(); ResultSet rs = stmt.executeQuery(query); ``` A SAST tool parses this and traces the data flow: ``` request.getParameter("id") ← User-controlled input (tainted source) ↓ "SELECT * FROM users WHERE id = " + input ← Concatenated into SQL ↓ stmt.executeQuery(query) ← Executed as database command (dangerous sink) Result: SQL Injection vulnerability — untrusted data reaches a SQL sink without sanitisation ``` The secure version uses a parameterised query that SAST recognises as safe: ```java // Secure — parameterised query prevents injection String query = "SELECT * FROM users WHERE id = ?"; PreparedStatement stmt = connection.prepareStatement(query); stmt.setString(1, request.getParameter("id")); ResultSet rs = stmt.executeQuery(); ``` SAST checks hundreds of these patterns across the OWASP Top 10 and more. ### What SAST Catches — and What It Misses SAST is excellent at catching: * Injection vulnerabilities — SQL, command, LDAP, XPath * Cross-site scripting (XSS) * Insecure cryptography — using MD5 for password hashing, hardcoded keys * Missing authentication or authorisation checks * Dangerous function calls — `eval()`, `exec()`, `system()` SAST cannot catch: * Runtime misconfigurations — a correctly written app deployed with wrong settings * Business logic flaws — the code is correct but the logic is wrong * Vulnerabilities in dependencies — that is SCA's job * Authentication bypasses that only appear when the app is running — that is DAST's job SAST produces false positives. Not every flagged finding is a real vulnerability. This is why SonarQube's quality gates are valuable — they let you tune what actually blocks a build versus what goes into a backlog. ---