What is Code Scanning?
Code scanning — SAST, DAST, and secure coding — told as a story about a guard who reads the drawing before building and knocks on the wall after.
A thousand pages, ten thousand bricks. No eye can check them all.The builder lays bricks every day. A crack is the size of one brick. One guard cannot look at them all.
The hired thief comes once a year. In between, the cracks stay open.The hired thief is the big test, so he comes rarely. Nobody looked at the bricks laid in between. Real thieves do not wait.
Read the drawing and knock on the wall — automatically, brick by brick.Before building, read the drawing to find cracks. After building, knock on the wall and listen for hollow spots. For bricks made by others, check the parts list too.
Reading gives too many flags; knocking is late but sure.Reading plants a flag on every maybe — including spots that are fine. Knocking finds only real hollows, but the wall has to be built first.
The builder learns too — how to lay without cracks from the start.Learn to lay without cracks, and have a fellow builder look it over. Checks run every day, every brick; the hired thief is the rare big test. Different jobs.
Code scanning = read the drawing for cracks before building, then knock on the wall for hollow spots after — automatically, brick by brick.
SAST (static analysis) reads source code without running it and flags vulnerable patterns; DAST (dynamic analysis) sends requests to the running app and watches how it really responds. SCA checks third-party libraries for known vulnerabilities. Secure coding and code review reduce cracks upstream.
When grown-ups say it
- SAST
- Reading the drawing. Finds cracks by reading the paper (code) before anything runs. Fast and wide, but plants many false flags.
- DAST
- Knocking on the wall. Sends requests at the built wall (the running app) and listens for hollows. Late, but real.
- SCA
- Checking the parts list. Checks bricks made by others (libraries) against known cracks, via the parts list. → the parts list on the tool
- Secure coding
- Laying without cracks. The builder's habits that stop cracks before they start: never trust what others hand you, never nail in a key. → the thief lesson
- False positive / false negative
- A flag on a fine spot / a crack missed. Reading gives many false positives; knocking can miss some. Use both so each covers the other.
- Code review
- A fellow builder looking over. Another builder looks before the brick goes in. Human eyes catch the why that tools cannot.
- Injection
- A command hidden inside a note. Read a visitor's note as-is, and the wall obeys whatever it says. The crack that reading catches best. → the note reviewer at the counter
- Versus a pentest
- The daily check / the occasional thief. Checks run automatically every day; the hired thief comes rarely and digs deep. Neither replaces the other. → the thief we hired