In my last article , I mentioned that my SAST tool uses regex-based pattern matching instead of AST parsing, and that this was a deliberate tradeoff. A few people asked me to go deeper on that decision — because on the surface, it sounds like I took a shortcut. I didn't. Or rather — I did, but it was an informed shortcut, and there's a meaningful difference. Let me explain what AST parsing actually is, why it's considered the "correct" approach, why I chose not to use it, and — most importantly — when that choice would be the wrong one. First, What's the Difference? When your SAST tool scans a file, it needs to understand what the code is doing. There are two fundamentally different ways to approach this. The Regex Approach Regex treats source code as plain text and looks for patterns that look like vulnerabilities.…