Static Application Security Testing (SAST) is a technique of analyzing source code to identify security vulnerabilities. It is typically performed early in the development process to catch issues before the code is deployed. Here’s some general guide to performing SAST testing:

Integrate the tool into your development process or into your continuous deployment (CI/CD) pipeline to automate scans with every build or deployment.

Configure the tool settings to your project's requirements.

Run the Scan/Analysis. Schedule regular scans to continuously monitor for new vulnerabilities as code changes.

Review and Prioritize Findings.

Fix identified issues based on priority. It’s crucial to address critical and high-severity vulnerabilities first.

After fixing vulnerabilities, re-scan the code to verify that the issues have been resolved.

As continuous improvement you should regularly update the SAST tool and its rule sets to keep up with new vulnerabilities and attack vectors.

Review and refine your security practices and SAST processes to improve over time. Performing SAST testing as part of a comprehensive security strategy helps identify and mitigate security risks early.