SAST and DAST Pipeline Integration

Prerequisites: Docker installed, a small local web application to scan (OWASP Juice Shop, run via Docker, works well and is designed for exactly this purpose), and Semgrep installed (pip install semgrep or via the Semgrep CLI).

SAST (Static Application Security Testing) reads source code without running it, looking for known-dangerous patterns — string-concatenated SQL, disabled certificate validation, use of a deprecated crypto function. DAST (Dynamic Application Security Testing) runs the application and attacks it from the outside like a real adversary would, over HTTP, with no knowledge of the source. They catch different, largely non-overlapping classes of bugs: SAST catches a SQL-injection-shaped code pattern even in a code path nobody's manually tested yet; DAST catches an actual exploitable SQL injection that only manifests once the app, its framework, its middleware, and its configuration are all combined and running.

Running both isn't redundant — it's the accepted way to get meaningfully broad coverage without either tool doing the other's job badly. You'll run each against the same known-vulnerable application (OWASP Juice Shop, deliberately built full of real, catalogued vulnerabilities for training and tooling purposes) and compare what each one finds.