Before promoting custom city code, the AppSec lead wants defects found without executing the program. Which testing approach belongs in the pipeline?
Select an answer to reveal the explanation.
Short Explanation
SAST is like proofreading the blueprints before you build the bridge—you catch cracks without driving trucks over it yet. Running it in the pipeline flags insecure patterns in custom city code early. That's cheaper than apologizing to citizens later.
Full Explanation
SAST analyzes application source or intermediate representations without executing the program, identifying coding flaws such as injection patterns and unsafe APIs. Integrating SAST into CI provides early feedback on custom code risk. It complements, rather than replaces, dynamic and composition analysis.