SECAI Core · phase 12 of 15 · noun
Static application security testing
Testing that is done early in the software development life cycle to examine the code for security vulnerabilities.
The Explain card
- Plain English
- SAST examines source code for security vulnerabilities early in the development cycle, without running the program. It reads the code the way a reviewer would, just faster and more tirelessly.
- Example
- A SAST scan flags that an AI agent's tool handler concatenates model output straight into a shell command, catching a command injection path before the feature ever reaches staging.
- Why it matters
- AI applications generate and consume untrusted strings constantly. SAST finds the dangerous sinks where model output meets system calls, queries, or HTML.
- Hook
- Proofreading the blueprint before the building goes up.
Word knowledge
How the word is built, where it came from, and what it sits beside in memory.
In a sentence
The CI pipeline runs static application security testing on each pull request and blocks merging when the scanner detects a high-severity SQL injection path.
Why these words
- static Greek statikos, causing to stand specifies that the software is not running during the activity
- application Latin applicatio, an attaching or joining identifies the software being examined
- security Latin securitas, freedom from care or danger names the area of concern
- testing English test plus the activity suffix -ing serves as the head noun naming the activity
Where it came from
- Origin
- an English technical compound built from static, application, security, and testing
- Entered the language
- 1990s
- What changed
- Static expanded from motionlessness to analysis without execution, application narrowed to software, and security testing became a specialized software-engineering expression.
How it is spelled
- Pattern
- static ends in the adjective suffix -ic
- Pattern
- application ends in the noun suffix -ation
- Pattern
- security ends in the noun suffix -ity
- Pattern
- testing adds -ing without changing test
Spelled like
- dynamic
- verification
- integrity
- scanning
Broken into chunks
-
stat-ic
- stationary
- statics
-
applic-ation
- applicable
- applicant
-
secur-ity
- secure
- securing
-
test-ing
- tester
- tested
What it sits beside
Same subject
- dynamic application security testing
- software composition analysis
- penetration testing
- secure code review
Same shape
- dynamic application security testing
- interactive application security testing
- mobile application security testing
application security testing methods
- static application security testing
- dynamic application security testing
- interactive application security testing
software security checks
- dependency scanning
- secret scanning
- container scanning
Where it sits in the deck
Phase 12: Defensive Technologies and Secure Development Practices
Map defences directly to the attacks just catalogued — the technical controls, secure coding practices, and protective tools that harden AI and traditional systems alike.
