Which type of security tool is most appropriate to integrate into the Continuous Integration (CI) pipeline to detect code-level security issues early?

Static code analysis (SAST) is ideal for CI pipelines because it automatically scans source code, bytecode, or binary code for security vulnerabilities without executing the program. This allows for early detection of issues like SQL injection, cross-site scripting, and buffer overflows as soon as code is committed, providing immediate feedback to developers. Penetration testing is a manual or semi-manual process performed on a running application, making it too slow and resource-intensive for every CI build. Threat modeling is a design-phase activity, not a code-level analysis tool for the pipeline. Dynamic code analysis (DAST) tests a running application, which occurs later in the pipeline or during testing phases, after the code has been built and deployed.