Static analysis

Tools inspecting code without running the app, looking for suspicious patterns, type mistakes, security bugs, and broken rules.

“find bugs without running the code”“scan source code for mistakes”“CI flagged a security problem in my source”“security scanner for source files”“check code before it executes”“static analisis”“code scanning”“catch mistakes without writing tests”

What it is

Static analysis inspects source code, bytecode, or another program representation without executing the application. Linters and type checkers are familiar forms. Tools such as Semgrep and CodeQL go further with taint tracking, following data flow to find patterns like untrusted input reaching a dangerous sink.

Run fast checks in the editor and on every pull request; reserve deeper whole-repository scans for CI when they cost more. Static analysis is particularly useful for rules that should hold everywhere, including forbidden APIs, missing validation, insecure defaults, and dependency usage conventions.

Gotcha: the tool sees a model of the program, not every runtime fact. Dynamic imports, generated code, framework magic, and external state can produce false alarms or hide real bugs. Tune noisy rules and review findings, but do not turn off a rule merely because fixing the first batch is inconvenient.

Ask AI for it

Add Semgrep static analysis to this repository. Create a GitHub Actions job that runs `semgrep scan --config auto --error --severity ERROR --sarif-output=semgrep.sarif` on pull requests, excludes generated and vendored directories, and uploads that SARIF file to GitHub code scanning. Add a local script with the same configuration, baseline the existing findings without suppressing new ones, and document how to justify a narrow inline suppression with the rule ID.

You might have meant

linting vs type checking vs testingend to end type safetycontinuous integrationrequired status checkssecure by default