Static Code Analysis (SAST) platforms analyze first-party source code — without executing it — to identify security vulnerabilities: injection flaws, insecure cryptography, authorization bugs, hard-coded credentials, memory-safety issues, and framework-specific anti-patterns. Core capabilities include multi-language support with language-specific semantic analyzers, data-flow and taint tracking to distinguish exploitable paths from theoretical ones, low-false-positive heuristics and ML-based triage, fix suggestions and autofix in PRs, custom-rule DSLs (Semgrep patterns, CodeQL), and IDE integration for real-time feedback. Modern SAST emphasizes speed and developer UX over the multi-hour scans of legacy products that developers routinely bypassed. Leading vendors include Semgrep, SonarQube Security, Snyk Code, Checkmarx SAST, Veracode SAST, Fortify (OpenText), and GitHub CodeQL.