AgentDAST / Guides
On this page
SAST vs DAST for AI-built apps: what each one catches
By Tornike@realtornikeo
SAST reads your code. Tools such as Semgrep work this way. DAST tests your running app. Tools such as ZAP work this way. For an AI-built app, that distinction decides what you find. The most common failures live in deployed access rules. Use both, in this order: SAST while you build, DAST after you deploy.
| Question | SAST | DAST |
|---|---|---|
| What it examines | Source code, without running the app | The live app, over HTTP, from outside |
| When it runs | In the editor, on a pull request, in CI | After deploy, against staging or production |
| Needs from you | Repository access | A reachable URL you are allowed to test |
| Strong on | Unsafe code patterns, with a file and line to fix | Deployed access control, exposed data, live config |
| Blind spot | Cannot confirm the deployed app allows the attack | Cannot point at the line of code to change |
| Typical tools | Semgrep, Snyk Code, CodeQL | AgentDAST, ZAP, Burp Suite DAST |
Four AI-built app failures, and who catches them
- Secret committed or bundled: a secrets scanner and SAST first. Live testing only helps if the secret is reachable in a response.
- Vulnerable dependency: SCA, the dependency scan sold beside SAST by Semgrep and Snyk. DAST may notice version hints. Package inventory belongs to SCA.
- Supabase table readable by anyone: database config checks such as Supabase Security Advisor, and DAST with the backend host in scope. The record for CVE-2025-48757 is the worked example: deployed RLS rules failed in production.
- One user reaching another user’s records: DAST and your own two-account tests. Only a live request proves the deployed boundary holds.
A free starting stack
On the code side, Semgrep lists a free edition for Code and Supply Chain, with Teams at US$30 per month per contributor. Snyk lists Free at US$0 with monthly test limits, and Team from US$25 per month. Note that Snyk sells DAST separately as API and Web, so a Snyk Code result alone is still only the code half. On the live side, AgentDAST includes 100 assessments per month free, with no card. Prices checked on 4 November 2026.
Where SCA, secrets scanning, and IAST fit
- SCA inventories open source dependencies and flags known-vulnerable versions. Semgrep Supply Chain and Snyk Open Source sit here.
- Secrets scanning looks for keys and tokens in code and history before they ship.
- IAST instruments the running app from inside while tests exercise it. It needs that instrumentation deployed.
AgentDAST is none of these. It is the outside view only. If a vendor bundles several of these layers, price the layers you will use, not the acronym count.
Which one first?
- No repo access, app built in a hosted builder: start with DAST and your platform config checks. See our vibe-coded app scanner comparison.
- You ship code daily: put SAST on pull requests now. Add a DAST run per release so deployment and rules get tested too.
- One check before a public launch: run a live assessment, then hand the evidence to the same coding agent that wrote the app. Fix, redeploy, and retest. That loop is the point of AgentDAST.
Limits
SAST findings can be real code and still not exploitable as deployed. DAST findings can be real exposures with no line number attached. AgentDAST is HTTP-only with no browser, and general observations need manual review. Only an exact capture flag match is confirmed automatically. Keep access-control tests in your own suite either way, per our AI-built checklist.
100 free assessments per month. No card required. Get a free API key.