During the design and build phase, ASAP performs static code analysis which examines source code without executing it to identify security vulnerabilities, coding errors, and policy violations. This allows issues to be found early when they're cheaper to fix.