0Pricing
Cyber Security Academy · Lesson

SAST and DAST in CI/CD Pipelines

Integrate SonarQube, Semgrep, or Bandit for static analysis and OWASP ZAP for dynamic scanning in pipelines.

SAST and DAST in CI/CD Pipelines is a free Cyber Security Academy lesson on CoddyKit — lesson 1 of 4. You can read the complete lesson below for free — then practise it hands-on in the browser with a built-in code editor and a 24/7 AI tutor. It is part of the Cyber Security Academy learning path, one of 4 lessons in the course, and your progress syncs across the web and the CoddyKit app.

What is Application Security Testing?

Application security testing identifies vulnerabilities before code reaches production. Two complementary approaches: SAST (static, without running code) and DAST (dynamic, testing a running application). Both can be integrated into CI/CD pipelines for shift-left security.

SAST: Static Application Security Testing

SAST analyzes source code, bytecode, or binary for security vulnerabilities without executing the code. It can run on every commit, providing fast feedback.

Strengths: catches bugs early, full code coverage, no running environment needed.

Weaknesses: high false-positive rate, language-specific, misses runtime configuration issues.

Popular SAST Tools

Open source SAST tools:

# Semgrep (multi-language, rule-based):
semgrep --config auto ./src

# Bandit (Python):
bandit -r ./src

# ESLint security plugin (JavaScript):
npx eslint --plugin security ./src

# SpotBugs + FindSecBugs (Java):
mvn spotbugs:check

Integrating SAST into CI/CD

Example GitHub Actions SAST step:

# .github/workflows/security.yml
- name: Run Semgrep
  uses: returntocorp/semgrep-action@v1
  with:
    config: p/owasp-top-ten
    auditOn: push
# Fail build if HIGH severity findings present

DAST: Dynamic Application Security Testing

DAST tests a running application from the outside, simulating an attacker. It discovers vulnerabilities only visible at runtime: authentication issues, session management flaws, input validation bugs.

Strengths: low false positives, language-agnostic, finds runtime config issues.

Weaknesses: needs a running environment, may miss code paths.

Popular DAST Tools

DAST tools for CI/CD:

# OWASP ZAP (free, scriptable):
docker run -t owasp/zap2docker-stable zap-baseline.py -t https://staging.app.com

# Nikto:
nikto -h https://staging.app.com

# Nuclei (template-based):
nuclei -u https://staging.app.com -t cves/

IAST: Interactive Application Security Testing

IAST instruments the application at runtime using agents that monitor code execution during functional testing. It combines SAST accuracy with DAST coverage. Examples: Contrast Security, Seeker. Requires language-specific agents and running tests.

Shifting Left with Security

Shift left means moving security testing earlier in the development lifecycle — ideally to the developer's IDE and commit stage rather than a separate pre-release gate. Earlier detection = cheaper fixes.

Cost multiplier: bug in dev costs 1x; in staging 10x; in production 100x.

Handling False Positives

SAST tools produce false positives. Managing them:

  • Use nosec (Bandit) or inline suppression comments for confirmed non-issues
  • Tune rule sets to the application context
  • Track suppression rationale in code comments
  • Review suppressions periodically

CI/CD Security Pipeline Architecture

A complete security pipeline:

  1. Pre-commit hooks: secrets scanning (gitleaks), SAST (semgrep)
  2. PR checks: SAST results, dependency scan (Dependabot)
  3. Staging deployment: DAST scan (ZAP baseline)
  4. Production: runtime monitoring (RASP, WAF)

Measuring AppSec Effectiveness

Key metrics for AppSec in CI/CD:

  • Mean time to remediate security findings
  • Finding rate per 1000 lines of code
  • False positive rate (drives developer trust)
  • Vulnerability escape rate (found in staging vs. prod)

Quick Check: SAST vs DAST

Which type of security testing analyzes source code without executing it, providing feedback directly in the CI pipeline on every commit?

Lesson Recap

SAST analyzes code statically (early feedback, high false positives); DAST tests running applications dynamically (runtime accuracy, needs environment). Both belong in CI/CD pipelines. Shifting left catches vulnerabilities when fixes are cheapest. Popular tools: Semgrep, Bandit (SAST); OWASP ZAP, Nuclei (DAST). Tune rule sets and track suppressions to manage false positives.

Frequently asked questions

Is the “SAST and DAST in CI/CD Pipelines” lesson free?

Yes — the full text of “SAST and DAST in CI/CD Pipelines” is free to read here on the web, and the Cyber Security Academy course includes 4 lessons in total. To practise it interactively (a built-in code editor and a 24/7 AI tutor) and unlock the rest of the Cyber Security Academy course, upgrade to CoddyKit PRO.

What will I learn in “SAST and DAST in CI/CD Pipelines”?

Integrate SonarQube, Semgrep, or Bandit for static analysis and OWASP ZAP for dynamic scanning in pipelines. You practise Cyber Security Academy with hands-on code you run directly in the browser, and a 24/7 AI tutor answers your questions as you work through the lesson.

Do I need any experience to start Cyber Security Academy?

No prior experience is required. Cyber Security Academy on CoddyKit is structured for beginners through advanced learners; this is — lesson 1 of 4, so you can start here or from the beginning and move at your own pace.

How long does the “SAST and DAST in CI/CD Pipelines” lesson take?

Most CoddyKit lessons take about 5–10 minutes. Each one is bite-sized and interactive, so you make steady progress and pick up exactly where you left off across the web and the app.

Can I write and run code in this Cyber Security Academy lesson?

Yes. Every Cyber Security Academy lesson includes a built-in code editor, so you write and run real code right in your browser and get instant AI feedback — no local setup required.

All lessons in this course

  1. SAST and DAST in CI/CD Pipelines
  2. Software Composition Analysis (SCA)
  3. Secrets Scanning and Hardcoded Credentials
  4. Security Champions and Threat Modeling
← Back to Cyber Security Academy