Static code scanning tools are used during daily builds or whenever code is submitted for scanning. It's the most effective method to identify security issues at the very beginning of software development. There are various kinds of static code scanning techniques. Refer to the OWASP Benchmark project if you would like to further evaluate these tools (https://www.owasp.org/index.php/Benchmark):
|
Techniques |
What is it? |
Examples |
|
Static Application Security Testing (SAST) |
Static code scanning. Developers can use the tool as part of the IDE plug-in or trigger scanning together with the daily build. It's considered a basic code scanning tool since it's easy for developers to use. |
FindSecbugs, Fortify, Coverity, ... |
