# What is CAST?

CAST = Continuous-on-Authoring Security Testing.

## CAST vs SAST

| Model | When it runs | Main job | Typical result |
| --- | --- | --- | --- |
| `CAST` | while the model is still writing code | stop unsafe output before it reaches the developer | `allow`, `redact`, `block` |
| `SAST` | after code already exists | scan code for vulnerabilities | findings after generation |
| `DAST` | against a running app | test runtime behavior | runtime issues after deployment or staging |
| `IAST` | inside an instrumented app | watch real execution paths | internal runtime findings |

The point is not that CAST replaces SAST.

The point is that CAST protects a different moment: **while code is being generated**.

## Example outcomes

| Example | What Cencurity Engine does |
| --- | --- |
| model outputs normal code | `allow` |
| model outputs a secret or token | `redact` |
| model outputs dangerous code like `eval(...)` | `block` |

## Finding fields

| Field | Meaning | Example |
| --- | --- | --- |
| `language` | code language family | `python` |
| `framework` | matched framework or artifact class | `fastapi` |
| `rule_id` | stable detection ID | `cast.fastapi.auth.jwt-verify-disabled` |
| `severity` | impact level | `high` |
| `confidence` | confidence score | `high` |
| `action` | enforcement result | `block` |
| `evidence` | matched evidence snippet | `eval(user_input)` |