Which type of testing is used to identify security vulnerabilities in source code in the development environment?

Dynamic analysis security testing (DAST) analyzes a running application from the outside by simulating attacks, identifying vulnerabilities that are exploitable in the runtime environment.

Interactive application security testing (IAST) combines elements of SAST and DAST, running within the application and analyzing code while it's executing, but SAST is specifically for *source code in the development environment* without execution.

Static analysis security testing (SAST) analyzes an application's source code, bytecode, or binary code without actually executing the program. It identifies potential security vulnerabilities, coding errors, and adherence to coding standards directly in the development phase, before deployment.

Runtime application self-protection (RASP) is a technology that detects and blocks attacks on a running application in real-time by instrumenting the application itself, rather than a testing method for source code vulnerabilities during development.