> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/set-up-sto-scans/static-application-security-testing.md).

# Static Application Security Testing - SAST

Static Application Security Testing (SAST) is a security testing practice that analyzes source code or binaries for potential vulnerabilities without executing the application. It is a crucial process for identifying and addressing security risks early in the software development lifecycle (SDLC).

With Harness Security Testing Orchestration (STO), you can easily perform SAST using a wide range of [integrated scanners](#supported-scanners-for-sast). STO also applies its own features, such as results normalization, the deduplication of findings within each scanner, and formatting results to make them actionable.

### Set up SAST scanning with Harness STO <a href="#set-up-sast-scanning-with-harness-sto" id="set-up-sast-scanning-with-harness-sto"></a>

You can use any of the [integrated scanners](#supported-scanners-for-sast) that perform SAST scanning, or you can leverage the Harness STO [Built-in Scanner workflow](/security-testing-orchestration/use-sto/set-up-sto-scans/built-in-scanners.md). The Built-in Scanner step enables you to set up scans without the need for paid licenses or complex configurations. Currently, the Built-in Scanner uses Semgrep, and adding it via the SAST step automatically integrates [Semgrep](/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/semgrep/semgrep-scanner-reference.md#configure-semgrep-as-a-built-in-scanner) into your pipeline with everything configured. Alternatively, follow the specific integration guides linked below for detailed configuration steps.

{% embed url="<https://youtu.be/qFnS6X4d5Ro?si=2s1oTw2f8q-mzrkx>" %}

#### Supported Scanners for SAST <a href="#supported-scanners-for-sast" id="supported-scanners-for-sast"></a>

Below is the list of supported SAST scanners in Harness STO:

If the scanner you use for SAST scanning is not listed, you can explore additional [scanners](/security-testing-orchestration/3.0/use-sto/sto-custom-scanning-and-ingestion/custom-scan-reference.md) that are compatible with the [Custom Scan step](/security-testing-orchestration/3.0/use-sto/sto-custom-scanning-and-ingestion/custom-scan-reference.md). If the Custom Scan step does not support the scanner you need, you can use the [Custom Ingestion](/security-testing-orchestration/3.0/use-sto/sto-custom-scanning-and-ingestion/custom-ingest-reference.md) step to ingest and process your scan results.

### Next steps <a href="#next-steps" id="next-steps"></a>