While the code is still in the development environment, a security architect is testing the code stored in the code repository to ensure the top ten OWASP secure coding practices are being followed…

Static Application Security Testing (SAST) tools analyze source code or bytecode stored in a repository without running the application, enabling early detection of OWASP Top 10 issues such as injection flaws, insecure deserialization, and improper error handling. Because the code has not yet been deployed and is evaluated in place in the repository, static analysis is the appropriate and effective technique.

Dynamic analysis requires the application to be actively running, so it cannot be applied to code sitting in a repository that has not been deployed or executed.

A fuzzer sends random or malformed input to a running application to cause crashes and cannot evaluate coding practices in a non-executing code repository.

Peer review relies on human inspection rather than automated tooling and lacks the systematic, consistent coverage needed to reliably verify compliance with all OWASP secure coding practices.