Linting, SAST, and Static Analysis Are Not the Same Tool

Security tooling terminology is frequently misused, with dashboards often labeling basic linters as SAST tools despite meaningful functional differences between the categories. Static analysis is the broadest term, covering any code inspection performed without execution, while SAST specifically targets security vulnerabilities through interprocedural, cross-file data-flow analysis run inside CI/CD pipelines. Linting operates at the narrowest scope, performing fast, single-file pattern checks at edit time with no cross-file tracing capability. Security linting is a subset of linting focused on security-relevant patterns visible within a single file, such as SQL string concatenation or weak token generation. Understanding these distinctions matters in practice because a linter cannot detect vulnerabilities where tainted data crosses file boundaries, a task that requires the deeper interprocedural analysis only a true SAST tool provides.