What is the difference between SAST and DAST, and where does each fit in a CI/CD pipeline?

SAST (Static Application Security Testing) analyzes source code without running it, catching issues like insecure coding patterns or known-vulnerable dependencies early, typically as part of the build/CI stage. DAST (Dynamic Application Security Testing) tests a RUNNING application by actually sending crafted requests (like a controlled attacker would), typically run against a staging environment before production release, catching runtime/configuration issues that static analysis can't see.