Glossary: Vulnerability, Asset and Change Management

Static code analysis

Also written: static analysis, Semgrep

Automated tools, such as Semgrep, that scan code for risky patterns like SQL built from input. They can't know business rules, such as "show only the customer's own orders".