SECAI Core · phase 12 of 15
Static application security testing
Testing that is done early in the software development life cycle to examine the code for security vulnerabilities.
The Explain card
- Plain English
- SAST examines source code for security vulnerabilities early in the development cycle, without running the program. It reads the code the way a reviewer would, just faster and more tirelessly.
- Example
- A SAST scan flags that an AI agent's tool handler concatenates model output straight into a shell command, catching a command injection path before the feature ever reaches staging.
- Why it matters
- AI applications generate and consume untrusted strings constantly. SAST finds the dangerous sinks where model output meets system calls, queries, or HTML.
- Hook
- Proofreading the blueprint before the building goes up.
Where it sits in the deck
Phase 12: Defensive Technologies and Secure Development Practices
Map defences directly to the attacks just catalogued — the technical controls, secure coding practices, and protective tools that harden AI and traditional systems alike.
