Module 2 · SAST, DAST & SCA in CI 🔒

SAST, DAST, and SCA are the three scanner classes that anchor a DevSecOps pipeline. This module covers what each actually detects, how to choose tools, and how to wire them into CI without turning your build times into a latency incident.

Clear definitions

• SAST (Static Application Security Testing): analyzes source code or compiled bytecode without running it. Detects code-level patterns — SQL injection via unsanitized input, hardcoded crypto keys, unsafe deserialization. Strengths: broad coverage, language-aware. Weaknesses: false positives, limited data-flow reach for dynamic languages
• DAST (Dynamic Application Security Testing): interacts with the running application via HTTP, attempts attacks, observes responses. Detects runtime behaviour — reflected XSS that actually fires, SQL errors surfaced by a specific payload, weak auth flows. Strengths: tests real runtime behaviour. Weaknesses: needs staging deployment; coverage depends on what the scanner can reach
• SCA (Software Composition Analysis): inventories the libraries your code depends on; compares against vulnerability databases. Detects “your code uses log4j 2.14.0 which has CVE-2021-44228.” Strengths: fast, deterministic. Weaknesses: only as good as the database; doesn’t know whether the vulnerable function is actually reached from your code

SAST — tool landscape in 2026

• Semgrep — open source + commercial, fast, rule-based pattern matching in 30+ languages. Sweet spot for startups. Rule authoring is accessible — you can write custom rules for your codebase’s specific patterns
• SonarQube / SonarCloud — broad language support, quality and security combined. Free tier for public repos, paid for private
• Snyk Code — AI-assisted. Good JavaScript/TypeScript/Python coverage. Paid
• Checkmarx — enterprise, deep dataflow analysis, slow, expensive. Common in banking/FSI
• Veracode — SaaS, cloud-analysis model. Reports are audit-friendly
• GitHub Advanced Security (CodeQL) — if you are already on GitHub, the integration ease is significant. Strong Java, C/C++, Go, Python

For most teams: start with Semgrep (free tier catches 70% of common issues) + GitHub code scanning. Upgrade only when you need specific features.

SAST integration — the minimal CI job

# .github/workflows/security.yml
name: Security Scan
on: [pull_request]

jobs:
  semgrep:
    runs-on: ubuntu-latest
    container: returntocorp/semgrep
    steps:
      - uses: actions/checkout@v4
      - run: |
          semgrep ci \
            --config p/security-audit \
            --config p/owasp-top-ten \
            --config p/r2c-ci \
            --sarif --output semgrep.sarif
      - uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: semgrep.sarif

Managing SAST false positives

The single biggest reason SAST programs die: too many false positives, developers stop reading reports. Tuning approaches:

# Example with ZAP
docker run -t owasp/zap2docker-stable zap-api-scan.py \
  -t https://api.staging.example.com/openapi.json \
  -f openapi \
  -z "-config scanner.attackMode=HIGH"

# Or with StackHawk
hawk scan --api openapi.json --env staging