What is SAST, and which SAST tool should your business use?

Bank Negara Malaysia's current Risk Management in Technology (RMiT) policy, issued on 25 September 2026, says a financial institution must have source code changes to critical systems reviewed before they go live. Banks are not the only ones at risk. The Cyber Security Agency of Singapore (CSA) warns that unreviewed code can introduce vulnerabilities into an app.

SAST in one sentence. Static application security testing (SAST) is software that reads your code without running it and helps find security flaws before release.

Which SAST tool fits you?

Part 1 explains how to choose in plain English. IT managers and developers can jump to Part 2.

Part 1: SAST for business owners

What a SAST tool finds

SAST is a form of static code analysis: checking code without running it. Two common finds:

• A password or access key left in the code. SonarQube, for example, detects exposed secrets in source code and configuration files.
• A gap that lets an attacker's input reach your database. This is called an injection flaw. Many SAST tools trace the input through the code to where it is used. This is called taint analysis.

SAST tools can run inside the developer's code editor. They can also run each time your developers build a new version of the software.

Why your business should care

For every business. OWASP, the open web security community, says a flaw found while the developer writes the code can save time and effort, compared with finding it later. NIST, the US standards body, says automated tools lower the effort needed to find flaws before release.

In Malaysia. RMiT's source code review rule applies to a financial institution and its critical systems. RMiT does not use the term SAST, but its guidance says a financial institution may deploy automated tools, including code scanning. Part 2 lists the clauses, and our RMiT source code review guide explains them.

In Singapore. The Monetary Authority of Singapore (MAS) says a financial institution may use a mix of static, dynamic and interactive application security testing, and should fix major issues before production. For mobile apps, CSA recommends its Safe App Standard 2.0.

SAST vs DAST

SAST checks the code without running it. DAST (dynamic application security testing) tests the software while it runs; MAS defines it as tools that detect exploitable vulnerabilities in a system in its run-time state. One does not replace the other: NIST lists testing of the running software as its own practice.

The six tools, in plain English

• SonarQube checks security, reliability (bugs that make software fail) and maintainability (code that is hard to change safely) in the same analysis. You can use SonarQube Cloud, which Sonar runs for you online, or SonarQube Server on your own servers. There is also a free edition, Community Build, with fewer features.
• GitLab SAST is part of GitLab. Basic SAST runs in every GitLab plan, including Free. The deeper scanning and the vulnerability management features are in the top plan, Ultimate.
• Semgrep Code is a SAST tool that lets your team write custom rules. Semgrep's core engine is open source (free to use and inspect). As of October 2026, the Free Edition costs nothing for up to 10 contributors.
• Snyk Code is the SAST part of the Snyk platform. Developers see results in their code editor, where they store code, and in the automated steps that build each release (the pipeline). Snyk runs it for you online.
• Checkmarx One puts SAST next to other scans, such as testing of the running application and checks on open-source libraries. You can use it online or host it yourself.
• OpenText Fortify covers 44+ programming languages, according to OpenText. OpenText can run it for you online, or you can run it on systems you control.

How to choose: four questions

1. Where must your code stay? SonarQube Cloud keeps data in the EU, or in the US on its Enterprise plan. If your code must stay on your own servers, the options include SonarQube Server, GitLab Self-Managed, self-hosted Checkmarx, Fortify on systems you control, and Semgrep Enterprise, which supports on-premises source code management.
2. What do your developers already use? Already on GitLab? Try its built-in SAST first. Already pay for Snyk? Try Snyk Code first. Neither? Compare the rest on questions 1, 3 and 4.
3. Do you want code quality checked too? SonarQube reports security and code quality issues in one analysis. If you need only security checks, skip this question.
4. How do you want to pay? As of October 2026:
   • per user (GitLab);
   • per contributor, meaning each person who commits code (Semgrep);
   • per plan and number of developers (Snyk);
   • per server installation and lines of code (SonarQube Server);
   • by quote (Checkmarx, Fortify).

What SAST does not do

OWASP lists the limits:

• SAST tools can raise many false alarms.
• They find it hard to check login and access-control logic automatically.
• They often cannot find configuration problems, because those are not in the code.
• They find only part of an application's security flaws, so a person still has to judge the results.

So SAST works beside testing of the running software, such as a penetration test. Our guide to source code review vs penetration testing explains when you need each.

Getting SonarQube in Malaysia or Singapore

We are a Sonar reseller partner in Malaysia and Singapore. We sell every SonarQube plan, including annual SonarQube Cloud plans and SonarQube Server editions, and quote them in Ringgit or Singapore dollars. See how SonarQube pricing works, whether to buy direct or through a local reseller, and our SonarQube Malaysia and SonarQube Singapore pages.

Part 2: For IT managers and developers

SAST tools compared: deployment and how each is bought

From each vendor's own pages, October 2026. Plans and prices change, so check before you budget.

SonarQube by edition, as of October 2026

• Free Community Build: secrets detection without custom patterns, infrastructure-as-code analysis (CloudFormation, Kubernetes, Terraform) and security rules. Main branch only; no pull request analysis; no taint analysis.
• Developer edition and up, and SonarQube Cloud: taint analysis (injection detection). Pull request analysis on the Developer edition and up, and on the SonarQube Cloud Team plan. Sonar describes the Developer edition as adding stronger security on top of Community Build.
• Quality gates: on the paid editions, a quality gate result shows on each pull request, and a failed gate can block the merge.
• Advanced Security: advanced SAST into open-source dependencies, for JavaScript/TypeScript, Java and C#/.NET, plus software composition analysis; a paid product on SonarQube Server, starting at the Enterprise edition.
• SonarQube for IDE: a free editor extension that highlights issues as you type; connected mode links it to your SonarQube project so you catch issues before you commit.

Pull requests

A pull request is the step where a change is reviewed before it joins the main code. SonarQube's paid editions report results there, with the quality gate status; Snyk Code offers pull request checks through its web interface; and GitLab Ultimate shows new SAST findings in merge request reports.

Malaysia: what RMiT says

• S 10.10 (mandatory): a financial institution must ensure changes to the source code of critical systems get adequate source code reviews before the change.
• S 10.6: for rapid development such as DevOps, a financial institution shall automate security compliance review and the discovery and testing of security vulnerabilities.
• G 10.14 (guidance): a financial institution may deploy automated tools, including code scanning.
• Appendix 5, Part E 1(h): periodic security assessments of APIs, including static / dynamic security testing; Appendix 5 is mandatory under S 11.5.
• RMiT never uses the term SAST. SonarQube supports your evidence; it does not make you compliant, and your auditor still decides.

Singapore: MAS TRM, CSA and SHIP-HATS

• MAS TRM (January 2021): Annex A defines SAST as tools that scan static source code, byte code and binaries for coding and design flaws that indicate security vulnerabilities. A financial institution may combine static, dynamic and interactive testing (6.1.6), should track issues and remediate major ones before production (6.1.7), and should apply these standards in Agile delivery.
• CSA Safe App Standard 2.0: a recommended standard for mobile apps; Code Quality and Exploit Mitigations is one of its areas; CSA strongly encourages, but does not require, it for apps developed and hosted in Singapore.
• SHIP-HATS: GovTech's documentation (checked 27 September 2026) says its SHIP-HATS developer platform offers SonarQube as a managed code quality and security analysis tool.
• Remediation Agent: according to Sonar, the SonarQube Remediation Agent was launched globally at ATx Summit 2026 and developed with IMDA as a strategic design partner. In May 2026, Sonar said it would be a paid offering.

Data residency

SonarQube Cloud is available in two regions, EU and US; the region cannot be changed after sign-up, and the US region needs an Enterprise plan. For code that must stay in Malaysia or Singapore, self-managed options include SonarQube Server and the free Community Build, GitLab Self-Managed, self-hosted Checkmarx, off-cloud Fortify and Semgrep Enterprise with on-premises source code management.

Frequently asked questions

Sources

• OWASP: Source Code Analysis Tools and Static Code Analysis
• NIST: SP 800-218, Secure Software Development Framework
• Bank Negara Malaysia: Risk Management in Technology policy document (25 September 2026)
• Monetary Authority of Singapore: Technology Risk Management Guidelines (January 2021)
• Cyber Security Agency of Singapore: Safe App Standard 2.0 and press release
• GovTech SHIP-HATS SonarQube overview (developer.tech.gov.sg; checked 27 September 2026, not reachable on 25 October 2026)
• Sonar: Remediation Agent press release (hosted by EDB), Server editions, Advanced Security, Community Build feature comparison, SonarQube Cloud regions, plans and pricing
• GitLab: SAST docs, Advanced SAST, pricing
• Semgrep: licensing, Semgrep Code overview, pricing
• Snyk: Snyk Code docs, plans
• Checkmarx: SAST, pricing
• OpenText: Fortify SAST, Fortify on Demand