Techniques of SAST Tools in the Early Stages of Secure Software Development: A Systematic Literature Review

Code analysis is an activity that requires multiple resources, especially when seeking to identify vulnerabilities that compromise the integrity of the software, as it necessitates specialized personnel. Even with this, a considerable amount of time is required to cover all the code. Static application security testing (SAST) tools allow for the analysis of source code without needing a compiled version through static analysis. This work presents an introduction to SAST tools and various techniques, such as static code-level analysis, syntactic analysis, code scanning, code similarity, pattern similarity, and taint analysis. It describes the generic functioning of SAST tools, which transform the source code into a comprehensible model for the tool, then use analysis algorithms to finally generate a report of results. The integration of SAST tools in the early stages of software development is analyzed, leveraging their automation and integration with version control, as well as compatibility with multiple programming languages for greater coverage. This research also addresses the limitations encountered when using SAST tools, such as the high rate of false positives and limited coverage, which requires the use of multiple tools for acceptable vulnerability detection. However, it highlights the importance of early vulnerability detection and the automation of the code analysis process, providing quick and efficient mechanisms.