What is SAST and which CI/CD stage integrates it best?

WHAT THIS TESTS: This question checks whether you understand the shift-left security mindset and can map a specific security practice to the correct automation layer in a CI/CD pipeline. It reveals if you know the difference between static and dynamic testing, and whether you can justify tooling placement with cost-of-fix reasoning rather than simply naming a stage.

A GOOD ANSWER COVERS: Four things in order. First, a crisp definition of SAST as automated scanning of source code for known vulnerability patterns before the application is compiled or deployed. Second, the specific stage placement, which is the test stage running on every commit and merge request pipeline so feedback is immediate. Third, the why, grounded in two points: vulnerabilities are cheapest to fix during development when the code context is fresh, and catching flaws before merge prevents them from reaching production where remediation costs jump by orders of magnitude. Fourth, a nod to practical integration, such as using a GitLab CI template or similar to inject the SAST job automatically without forcing developers to run manual scans.

COMMON WRONG ANSWERS: Three red flags stand out. One, saying SAST runs in production or during post-deploy monitoring, which confuses static analysis with DAST or runtime security. Two, suggesting it should run only in scheduled nightly pipelines or manual security reviews, because this destroys the fast-feedback loop that makes shift-left effective. Three, describing SAST as a tool that requires human triage before every deployment, which misses the point that modern pipelines treat security scanning as automated gatekeeping with results surfaced directly in merge requests.

LIKELY FOLLOW-UPS: An interviewer might push on how you handle false positives that break builds, how you prioritize findings when hundreds appear in a legacy codebase, or how SAST differs from dependency scanning and secret detection. They may also ask how you would enforce SAST in a pipeline without slowing down developer velocity, or what you do when a critical vulnerability is found in a release branch.

ONE CONCRETE EXAMPLE: In a GitLab workflow, you enable SAST by including the SAST template in your gitlab-ci.yml file. The scanner runs as a job under the test stage. When a developer pushes a branch, the pipeline triggers automatically. If the scanner finds a high-severity SQL injection pattern in a new controller file, the merge request widget shows the vulnerability immediately. The developer fixes the line in the same branch before merging, avoiding a costly production hotfix and keeping the main branch clean.