--- title: "#sast articles | Hashnode" description: "Explore 80 articles tagged #sast on Hashnode. Tutorials, guides, and how-tos from the community." url: "https://hashnode.com/tag/sast" --- Tag # #sast 80 posts · 6 followers [AngusKit](https://hashnode.com/@anguskit) · [Oct 19](https://hashnode.com/posts/capability-scoped-reports-sast-deps-images-secrets-licenses/6ad612ceea060a7f83ae274e) ### [Capability-scoped reports: SAST, deps, images, secrets, licenses](https://anguskit.hashnode.dev/capability-scoped-reports-sast-deps-images-secrets-licenses?utm_source=hashnode&utm_medium=feed) On top of the shared report snapshot, narrow by SAST, dependency CVEs, images, secrets, and licenses—plus external redaction and SARIF limits. 6 min read · [anguskit.hashnode.dev](https://anguskit.hashnode.dev/capability-scoped-reports-sast-deps-images-secrets-licenses?utm_source=hashnode&utm_medium=feed) [Rushabh Shah](https://hashnode.com/@rushabh5000) · [Oct 9](https://hashnode.com/posts/what-is-sast-static-application-security-testing/6ac8ac6c0fa664f9ffc08ee1) ### [What is SAST? A developer's guide to static application security testing](https://depwarden.hashnode.dev/what-is-sast-static-application-security-testing?utm_source=hashnode&utm_medium=feed) Static Application Security Testing (SAST) is the practice of analyzing source code — or bytecode, or compiled binaries — for security vulnerabilities without executing the program. A SAST tool reads 6 min read · [depwarden.hashnode.dev](https://depwarden.hashnode.dev/what-is-sast-static-application-security-testing?utm_source=hashnode&utm_medium=feed) [Umair Mirza](https://hashnode.com/@umairmirza) · [Sep 14](https://hashnode.com/posts/catch-security-vulnerabilities-code-pull-requests/6aa873c5c1f02b411d54db2f) ### [How to Catch Security Vulnerabilities in Code Before They Reach Your Pull Requests](https://freecodecamp.org/news/catch-security-vulnerabilities-code-pull-requests?utm_source=hashnode&utm_medium=feed) Security reviews are most effective when developers receive feedback while the code is still fresh in their minds. Waiting until a pull request, CI build, or penetration test to find exposed credentia 9 min read · [freecodecamp.org](https://freecodecamp.org/news/catch-security-vulnerabilities-code-pull-requests?utm_source=hashnode&utm_medium=feed) [Rushabh Shah](https://hashnode.com/@rushabh5000) · [Sep 10](https://hashnode.com/posts/sast-vs-sca-ci-pipeline-security-testing/6aa25189ea9c34fd737641cc) ### [SAST vs SCA: why your CI pipeline needs both](https://depwarden.hashnode.dev/sast-vs-sca-ci-pipeline-security-testing?utm_source=hashnode&utm_medium=feed) When security teams talk about "scanning" code in CI/CD, they usually mean one of two very different things: scanning the code you wrote (SAST) or scanning the open-source code you imported (SCA). Bot 5 min read · [depwarden.hashnode.dev](https://depwarden.hashnode.dev/sast-vs-sca-ci-pipeline-security-testing?utm_source=hashnode&utm_medium=feed) [Zennoxa](https://hashnode.com/@zennoxa) · [Aug 21](https://hashnode.com/posts/there-are-755-static-analysis-tools-only-42-are-open-source-security-scanners/6a87d1f4e43984a99c9e105f) ### [There are 755 static-analysis tools. Only 42 are open-source security scanners.](https://zennoxa.hashnode.dev/there-are-755-static-analysis-tools-only-42-are-open-source-security-scanners?utm_source=hashnode&utm_medium=feed) If you run a linter on your code today, you have a lot of choices. If you want one that actually looks for security bugs — and is open source — you have far fewer than the ecosystem's size suggests. W 4 min read · [zennoxa.hashnode.dev](https://zennoxa.hashnode.dev/there-are-755-static-analysis-tools-only-42-are-open-source-security-scanners?utm_source=hashnode&utm_medium=feed) [Manu Shukla](https://hashnode.com/@mr-manushukla) · [Jul 31](https://hashnode.com/posts/openai-codex-security-cli-in-ci-the-2026-setup-and-the-gated-engine-catch/6a6d0de1d984ed1b52b7ce07) ### [OpenAI Codex Security CLI in CI: the 2026 setup and the gated-engine catch](https://ecorpit.hashnode.dev/openai-codex-security-cli-in-ci-the-2026-setup-and-the-gated-engine-catch?utm_source=hashnode&utm_medium=feed) OpenAI Codex Security CLI in CI: the 2026 setup and the gated-engine catch Summary. OpenAI open-sourced the Codex Security CLI and TypeScript SDK on 29 July 2026 under an Apache-2.0 licence, as the pu 13 min read · [ecorpit.hashnode.dev](https://ecorpit.hashnode.dev/openai-codex-security-cli-in-ci-the-2026-setup-and-the-gated-engine-catch?utm_source=hashnode&utm_medium=feed) [vimalendukumar](https://hashnode.com/@hadsa) · [Jul 2](https://hashnode.com/posts/the-compliance-gap-your-security-scanner-can-t-see/6a46326dde157f634df6a883) ### [The Compliance Gap Your Security Scanner Can't See.](https://scrutora-blog.hashnode.dev/the-compliance-gap-your-security-scanner-can-t-see?utm_source=hashnode&utm_medium=feed) Security scans find vulnerabilities, not compliance gaps. Discover why modern engineering teams need both. 5 min read · [scrutora-blog.hashnode.dev](https://scrutora-blog.hashnode.dev/the-compliance-gap-your-security-scanner-can-t-see?utm_source=hashnode&utm_medium=feed) [Marios Grivas](https://hashnode.com/@unfoundedomnis) · [May 26](https://hashnode.com/posts/reverse-engineering-the-gov-gr-wallet-how-a-hardcoded-api-key-exposed-millions-of-citizens/6a15b169da253d50d4bf1ef5) ### [Reverse Engineering the Gov.gr Wallet: How a Hardcoded API Key Exposed Millions of Citizens](https://defprotocol.hashnode.dev/reverse-engineering-the-gov-gr-wallet-how-a-hardcoded-api-key-exposed-millions-of-citizens?utm_source=hashnode&utm_medium=feed) Discover how security by obscurity fails in mobile applications. Explore the gov.gr wallet case and learn best practices for API secrets management. 6 min read · [defprotocol.hashnode.dev](https://defprotocol.hashnode.dev/reverse-engineering-the-gov-gr-wallet-how-a-hardcoded-api-key-exposed-millions-of-citizens?utm_source=hashnode&utm_medium=feed) [Sourav Chakraborty](https://hashnode.com/@devsecopssourav) · [Apr 19](https://hashnode.com/posts/from-code-to-runtime-closing-the-appsec-gap-with-waf-devsecops/69e45358ee84f66e940b190e) ### [From Code to Runtime: Closing the AppSec Gap with WAF + DevSecOps](https://devsecopssourav.hashnode.dev/from-code-to-runtime-closing-the-appsec-gap-with-waf-devsecops?utm_source=hashnode&utm_medium=feed) from-code-to-runtime-closing-the-appsec-gap-with-waf-devsecops with SCA,SAST,DAST,WAF 6 min read · [devsecopssourav.hashnode.dev](https://devsecopssourav.hashnode.dev/from-code-to-runtime-closing-the-appsec-gap-with-waf-devsecops?utm_source=hashnode&utm_medium=feed) [Milan Nikic](https://hashnode.com/@nick79) · [Mar 23](https://hashnode.com/posts/diffguard-llm-powered-security-review-for-staged-git-diffs/69c1365d30a9b81e3a4973b8) ### [DiffGuard: LLM-Powered Security Review for Staged Git Diffs](https://securitydepth.hashnode.dev/diffguard-llm-powered-security-review-for-staged-git-diffs?utm_source=hashnode&utm_medium=feed) Open-source CLI tool that analyzes staged git diffs using tree-sitter AST context and LLM to find vulnerabilities with CWE classification and fixes. 17 min read · [securitydepth.hashnode.dev](https://securitydepth.hashnode.dev/diffguard-llm-powered-security-review-for-staged-git-diffs?utm_source=hashnode&utm_medium=feed)