static application security testing (SAST)