SAST vs DAST vs IAST
debt(d7/e5/b3/t5)
Closest to 'only careful code review or runtime testing' (d7) — the absence of SAST/DAST in a pipeline is visible only via CI configuration review; no tool flags 'you don't have security scanning configured' by default.
Closest to 'touches multiple files / significant refactor in one component' (e5) — per quick_fix, integrating PHPStan/semgrep in CI plus standing up OWASP ZAP against staging requires pipeline configuration, staging environment setup, and workflow integration across CI/CD.
Closest to 'localised tax' (b3) — applies_to web/api contexts; the tooling lives in CI/CD config and a staging job, adding maintenance load but not shaping application code itself.
Closest to 'notable trap most devs eventually learn' (t5) — the misconception that 'SAST alone is sufficient' is a documented gotcha; teams routinely learn the hard way that runtime classes of bugs (deserialisation, auth flow issues) escape static analysis.
Also Known As
TL;DR
Explanation
Static Application Security Testing (SAST) scans source code for vulnerabilities before execution — fast, early in CI, but produces false positives and cannot find runtime issues. Dynamic Application Security Testing (DAST) sends attacks against a running application from the outside — finds real vulnerabilities but requires a deployed app. Interactive AST (IAST) instruments the runtime and observes data flows during test execution — most accurate, fewest false positives, but complex to set up. PHP tools: PHPStan/Psalm (SAST), OWASP ZAP/Burp Suite (DAST).
Common Misconception
Why It Matters
Common Mistakes
- Running SAST only at release time — it should run on every commit in CI to catch issues early and cheaply.
- Ignoring SAST false positives instead of suppressing them — noise trains developers to ignore all alerts.
- DAST against production — always run DAST against a staging environment; it sends real attacks.
- Not integrating findings into the developer workflow — security results buried in a separate dashboard get ignored.
Code Examples
# SAST only in CI — misses runtime vulnerabilities:
# .github/workflows/ci.yml:
- run: vendor/bin/phpstan analyse # Good — catches type errors, code issues
# No DAST step — SQL injection via serialised objects not caught
# No dependency audit — known CVEs in vendor/ undetected# Layered security testing:
# CI (every commit): SAST
- run: vendor/bin/phpstan analyse
- run: composer audit # Known CVEs in dependencies
# Nightly / pre-release: DAST against staging
- run: docker run owasp/zap zap-baseline.py -t https://staging.example.com
# Code review: manual review of auth, crypto, input handling