Static Application Security Testing (SAST)

Static Application Security Testing (SAST) means analysing an app without running it. The tool reads the code, configuration and resources and looks for weaknesses such as hardcoded keys, weak settings and dangerous code patterns.

For mobile apps, SAST usually works from the compiled package (the APK, AAB or IPA), not the source. It decompiles the bytecode, unpacks native libraries and parses the manifest, which is the same material an attacker pulls off a device. SAST is fast and cheap, so it fits in the build pipeline on every release.

In Mobexa, static analysis runs on the exact build you ship and reports each finding with its location and a mapping to the OWASP MASVS control behind it.