SAST reads the source code

Static application security testing analyses code without running it, looking for dangerous patterns: input reaching a query unsanitised, a weak random number generator, a hard-coded credential.

It sees everything in the code, including paths that never run in practice, which makes it thorough and prone to noise in equal measure.