Static application security testing (SAST) scans for security flaws in the source code without running the program. It is a white-box testing method that is the counterpart to dynamic application software testing (DAST), which tests web applications for run-time vulnerabilities.