What Is Static Code Analysis?

SAST (Static Application Security Testing) is static analysis scoped specifically to security vulnerabilities. Static code analysis is the broader technique — the same parsing-and-rule-matching mechanism applies to architecture, accessibility, maintainability and dependency checks, not only exploitable vulnerabilities. See the dedicated SAST guide for the security-specific use case.

Not directly — anything that depends on actual input values, timing, or environment state at runtime is outside what static analysis can observe by definition. Taint analysis narrows this gap by tracing how untrusted data could flow through code without running it, but it is inference, not observation. That is what dynamic testing is for.

Because the underlying technique — parse the code, check the structure against rules — applies equally well to a missing ARIA label or an inline style as it does to a SQL injection pattern. Accessibility specifically also has growing regulatory weight (the European Accessibility Act 2025, for instance), which is why WCAG 2.1 mapping sits alongside CWE mapping rather than being a separate product.

It doesn't avoid them entirely — no static analyzer does, since it reasons about code structure without full runtime context. What varies enormously between tools is the false-positive rate, which depends on rule design (pattern-only rules are noisier than taint-tracking ones) and how conservatively a rule is scoped. Ask for a published, reproducible benchmark rather than a vendor's self-reported number — see real precision/recall benchmarks.

It depends on the tool. Some engines require a full build to construct a queryable database (common for deep semantic analysis of compiled languages). StaticCodeAudit does not — it parses source files directly with no build step, for any of its 8 supported languages, including compiled ones like Java and C#.