A software developer wants to test the code of an application for vulnerabilities. Which of the following processes should the software developer perform?

A vulnerability scan typically targets network infrastructure and running services to detect known CVEs and misconfigurations, not application source code.

Dynamic scanning (DAST) tests a running application by sending live inputs and observing behavior, rather than inspecting the source code itself.

Static analysis, also known as Static Application Security Testing (SAST), analyzes source code, bytecode, or binaries without running the application. This allows a developer to identify security flaws such as injection vulnerabilities, insecure function calls, and logic errors directly within the codebase during the development phase before deployment.

A compliance scan checks systems against regulatory or policy benchmarks such as CIS or NIST standards and does not analyze application code for security vulnerabilities.