What are SAST, DAST, SCA and container image scanning? Where does each fit in a CI/CD pipeline?

They are automated security checks. Each one looks at a different part of the app.

• SAST (Static Application Security Testing) reads your source code without running it. It finds risky patterns such as SQL built from strings, eval or hard-coded secrets. Examples: Semgrep, CodeQL. Run it on every pull request.
• SCA (Software Composition Analysis) checks your dependencies against lists of known vulnerabilities (CVEs). Examples: npm audit, Dependabot, Snyk, OSV-Scanner. Run it on every pull request and also on a daily schedule, because new CVEs appear for code you haven't changed.
• Secret scanning looks for keys and passwords in commits. Examples: gitleaks, GitHub secret scanning. Run it before commits and in CI.
• Container image scanning checks the OS packages and libraries inside the built image. Examples: Trivy, Grype. Run it after the image is built and before it's deployed, and rescan stored images regularly.
• DAST (Dynamic Application Security Testing) attacks the running app from outside, with no access to the code. Example: OWASP ZAP. Run it against a staging environment, for example every night.
• IaC scanning checks infrastructure code like Terraform or Kubernetes files for risky settings.

Fail the build on high-severity issues that have a fix, and sort out the rest. These tools find known patterns. They miss logic bugs like broken authorization, so code review and tests still matter.