# Static code analysis Static code analysis is a software development practice that examines source code without executing it to identify bugs, security vulnerabilities, and coding-style issues. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Neo Security: Securing Infrastructure in the Agentic Era DevFeed: [Neo Security: Securing Infrastructure in the Agentic Era]() Original publisher: [Read original article]() Author: Joe Duffy Published: 2026-08-28T00:00:00Z Content type: release Language: en Sources: [Pulumi]() Topics: [pulumi-neo](), [Security](), [cloud-infrastructure](), [Artificial Intelligence](), [Infrastructure as code](), [Static code analysis]() Tags: [agent](), [agentic](), [ai](), [aws](), [azure](), [cloud-infrastructure](), [infrastructure-as-code](), [kubernetes](), [product](), [pulumi](), [pulumi-neo](), [security]() ### AI overview Pulumi is opening a research preview of Neo Security, an agent that analyzes cloud infrastructure for exploitable flaws. It builds a threat model, maps attack paths, and produces an actionable security posture report, including for infrastructure provisioned across AWS, Azure, Google Cloud, and Kubernetes. ### Source excerpt Recently, AI systems have started turning up exploitable flaws in code that survived decades of human review. The frontier labs have released useful tools to help uncover many of these flaws through agent-led static code analysis. This is a huge leap ahead, but cloud infrastructure has many exploitable flaws that code analysis alone cannot find. These flaws are often as severe as the ones in code, or worse, and they await discovery by malicious agents on offense. We realized recently we can uniquely help here. At Pulumi, we have complete visibility into your entire cloud estate: infrastructure resources, their semantics, connections and dependencies between them, runtime logs and information, and more -- and have built an entire context graph out of them that is accessible to agents. Thanks to large language models, the cost of analyzing that full context graph is no longer prohibitive. As a result, today we're opening a research preview of Pulumi Neo Security. Neo Security is an agent that can find exploitable flaws in your cloud infrastructure. It starts with a threat model of your cloud estate, and then works systematically through every potential point of attack. The result is a security posture report that is immediately actionable thanks to Pulumi's infrastructure as code technology. Neo Security works on your existing infrastructure regardless of how it was provisioned, across any of our thousands of cloud providers including AWS, Azure, Google Cloud, and Kubernetes. We're releasing it in research preview to begin, so we can work closely with customers to run and address any findings. If you'd like to give it a try, contact us. How it finds attack paths Neo Security's aim is to provide a high-confidence, actionable security posture report. It gets there in three passes. The first builds a threat model, before it looks for anything. It works out what your crown jewels are, which resources are accessible to outside actors, which accounts hold production data, wh ## Reduce SAST false positives with agentic evaluation and Bits Memories DevFeed: [Reduce SAST false positives with agentic evaluation and Bits Memories]() Original publisher: [Read original article]() Author: Cole Maring Published: 2026-07-06T00:00:00Z Content type: article Language: en Sources: [Datadog | The Monitor blog]() Topics: [Static code analysis](), [Application Security](), [Artificial Intelligence](), [bits ai](), [Vulnerabilities](), [Security]() Tags: [agentic](), [ai](), [analysis](), [application-security](), [bits-ai](), [code](), [code-security](), [developer](), [devsecops](), [learn](), [post](), [security](), [threat-detection](), [tools](), [vulnerabilities](), [vulnerability-management]() ### AI overview Datadog's Static Code Analysis uses Bits AI agentic evaluation to investigate SAST findings across a repository, combining related code paths, callers, and validators with organization-specific knowledge from Bits Memories. The goal is to distinguish true vulnerabilities from false positives and speed security triage. ### Source excerpt Learn how Bits AI in Datadog Static Code Analysis uses repository-wide reasoning and custom context to help make security triage faster and more accurate. ## Identifying insecure C Code with Valgrind and fixing with Snyk Code DevFeed: [Identifying insecure C Code with Valgrind and fixing with Snyk Code]() Original publisher: [Read original article]() Author: Liran Tal Published: 2024-09-24T05:00:00Z Content type: tutorial Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [C](), [Static code analysis](), [Memory Leaks](), [Vulnerabilities](), [C++](), [Security](), [snyk-code]() Tags: [analysis](), [awareness](), [blog](), [c](), [c-cpp](), [c-plus-plus](), [code-security](), [developer](), [devops](), [devrel](), [docker](), [how-to](), [memory-leaks](), [memory-management](), [programming](), [security](), [snyk-code](), [vulnerabilities]() ### AI overview This tutorial explains how insecure C and C++ code can introduce memory leaks and other vulnerabilities, and describes using Valgrind and Snyk Code's static code analysis to identify and fix them. It also discusses dynamic memory allocation, memory exhaustion, and relevant MISRA guidance. ### Source excerpt Discover how to secure your C and C++ code with Snyk. Learn about common vulnerabilities like memory leaks and buffer overflows in C and C++ and how Snyk's static code analysis tool can help you identify and fix them. Protect your critical software from security threats. ## How Axel Springer National Media and Tech achieved continuous security with Snyk DevFeed: [How Axel Springer National Media and Tech achieved continuous security with Snyk]() Original publisher: [Read original article]() Author: Nina McClure Published: 2024-09-03T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Security](), [Vulnerabilities](), [snyk-open-source](), [Application Security](), [snyk-code](), [Static code analysis](), [Infrastructure as code](), [Development](), [Amazon Web Services](), [Containers](), [Open Source]() Tags: [application-security](), [awareness](), [aws](), [blog](), [ciso](), [code-security](), [containers](), [customer](), [customer-featured](), [development](), [devops](), [executive](), [iac](), [interest](), [megawatt](), [open-source-security](), [security](), [shift-left](), [snyk](), [snyk-code](), [snyk-open-source](), [vulnerabilities]() ### AI overview This customer story describes how Axel Springer National Media and Tech adopted Snyk after Log4Shell to help developers find and fix vulnerabilities earlier. It covers the implementation of Snyk Code and Snyk Open Source within existing development processes, alongside developer-managed IaC on AWS and security responsibilities shared across teams. ### Source excerpt Find out how Axel Springer's National Media & Tech business division uses Snyk to empower its developers to find and fix vulnerabilities in their own code. ## Getting started with PHP static analysis in 2024 DevFeed: [Getting started with PHP static analysis in 2024]() Original publisher: [Read original article]() Author: Liran Tal Published: 2024-03-21T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [PHP](), [Static code analysis](), [Code quality](), [Security](), [Vulnerabilities](), [Refactoring](), [Back end](), [debug](), [Web Development]() Tags: [awareness](), [blog](), [code-security](), [developer](), [devrel](), [engineering](), [metrics](), [php](), [production](), [readability](), [refactoring](), [security](), [security-vulnerabilities](), [snyk-code](), [web-development]() ### AI overview This article introduces static analysis for PHP development. It explains how examining PHP source code without executing it can detect errors, security vulnerabilities, coding-standard violations, and complex code early, helping developers improve code quality before deployment. ### Source excerpt In this post, we cover the basics of static analysis and how to secure your PHP code in 2024. ## Automating Code Analysis in Android Projects DevFeed: [Automating Code Analysis in Android Projects]() Original publisher: [Read original article]() Author: Kirill Rozov Published: 2021-09-20T18:11:42Z Content type: tutorial Language: en Sources: [Stories by Kirill Rozov on Medium]() Topics: [Android](), [Static code analysis](), [Code](), [Java](), [Kotlin](), [ci](), [ide]() Tags: [also](), [android](), [ci](), [code](), [code-analysis](), [code-quality](), [code-quality-tools](), [development](), [ide](), [java](), [kotlin]() ### AI overview This tutorial explains how to automate code analysis in Android projects. It distinguishes static analysis, which can run during development or in CI, from dynamic analysis, which runs the application to detect issues such as memory leaks. It also introduces IDE inspections as a code-analysis tool. ### Source excerpt Source unsplash.com/photos/Tjbk79TARiEAutomation of code analysis in Android projectsHello. My name is Kirill Rozov, and if you are interested in Android development, then most likely you have heard about the Android ResId Telegram channel with daily news for Android developers.https://medium.com/media/ff8acd16dd7b4b03a485bf9baab3c9d6/href Modern mobile applications are already quite serious enterprise projects that are developed by hundreds of developers, contain thousands of lines of code and are constantly changing and developing. The process of automating code checking and application work helps to deal with such a huge codebase. Today I will tell you what tools you can use to improve the stability of your project and avoid mistakes, as well as save time for colleagues during a pull request. Are you developing a project with a small team or alone? Then this article is even more important to you, since you most likely didn't configure any checks for yourself, and I will tell you why this needs to be done. Types of code checking Code analyzers is divided on two types: static code analysis (without starting the application) code analysis while the application is running Android development uses statically typed compiled languages: Java and Kotlin. These are important requirements for languages that allow them to analyze code without having to run it, and they can do it right at the time of writing the code. This type of analysis is called static. This makes it easy to run analyzing on any CI and automate checking for simple errors, such as not closing a stream after reading/writing code. The disadvantage of such checks is that if your code deviates from the template embedded in it, then the code will not work or will work incorrectly. Also, such analyzers can't understand complex code execution scenarios and their effect. More serious checks of your code can be done by automatically analyzing it while the application is running (dynamic). For example, you can tra ## Escape-Analysis Flaws DevFeed: [Escape-Analysis Flaws]() Original publisher: [Read original article]() Published: 2018-01-22T00:00:00Z Content type: article Language: en Sources: [William Kennedy]() Topics: [Go Language](), [Compiler](), [Static code analysis](), [toolchain]() Tags: [analysis](), [ardan-labs](), [benchmark](), [blog](), [code-analysis](), [compiler](), [escape-analysis](), [go](), [go-programming](), [golang](), [memory-management](), [pointers](), [programming](), [series]() ### AI overview This article examines unresolved flaws in Go's escape analysis, a compiler analysis that enables memory-management optimizations. It identifies five flaws that had not been fixed at the time of writing and explores their potential impact on existing Go programs, based on the Go 1.9 compiler. ### Source excerpt Prelude It will be helpful to read this four-part series first on escape analysis and data semantics. Details on how to read an escape analysis report and pprof output have been outlined here. https://www.ardanlabs.com/blog/2017/05/language-mechanics-on-stacks-and-pointers.html Introduction Even after working with Go for 4 years, I am continually amazed by the language. Thanks to the static code analysis the compiler performs, the compiler can apply interesting optimizations to the code it produces. One type of analysis the compiler performs is called escape analysis. This produces optimizations and simplifications around memory management. ## Language Mechanics On Escape Analysis DevFeed: [Language Mechanics On Escape Analysis]() Original publisher: [Read original article]() Published: 2017-05-26T00:00:00Z Content type: tutorial Language: en Sources: [William Kennedy]() Topics: [Go Language](), [Static code analysis](), [Compiler](), [Code](), [cpu]() Tags: [ardan-labs](), [blog](), [compiler](), [cpu](), [escape-analysis](), [gc](), [go](), [go-programming](), [golang](), [memory](), [pointers](), [programming]() ### AI overview This tutorial explains heaps and escape analysis in Go. It describes how the compiler uses static code analysis to decide whether values remain on a function's stack or move to the heap, and discusses the resulting garbage-collection costs and possible latency. ### Source excerpt Prelude This is the second post in a four part series that will provide an understanding of the mechanics and design behind pointers, stacks, heaps, escape analysis and value/pointer semantics in Go. This post focuses on heaps and escape analysis. Index of the four part series: Language Mechanics On Stacks And Pointers Language Mechanics On Escape Analysis Language Mechanics On Memory Profiling Design Philosophy On Data And Semantics Introduction In the first post in this four part series, I taught the basics of pointer mechanics by using an example in which a value was shared down a goroutine's stack. What I did not show you is what happens when you share a value up the stack. To understand this, you need to learn about another area of memory where values can live: the "heap". With that knowledge, you can then begin to learn about "escape analysis". ## Static code analysis for free DevFeed: [Static code analysis for free]() Original publisher: [Read original article]() Published: 2014-10-20T00:00:00Z Content type: tutorial Language: en Sources: [Juri Strumpflohner]() Topics: [Static code analysis](), [JavaScript](), [Tooling](), [Jenkins](), [Web Development]() Tags: [code-analysis](), [javascript](), [jenkins](), [npm](), [report](), [reports](), [tooling]() ### AI overview This article introduces Plato, a free tool for static JavaScript analysis and reporting. It explains how to install Plato from npm, run it against a codebase, generate visual reports, and publish those reports through a Jenkins job. ### Source excerpt Lorem ipsum dolor sit amet ## Using Heartbleed as a starting point DevFeed: [Using Heartbleed as a starting point]() Original publisher: [Read original article]() Published: 2014-04-10T09:06:18Z Content type: opinion Language: en Sources: [Antirez]() Topics: [openssl](), [Security](), [code security](), [Static code analysis](), [C]() Tags: [c](), [code-analysis](), [code-security](), [open-source](), [openssl](), [security]() ### AI overview The article uses the Heartbleed vulnerability in OpenSSL as a starting point for discussing how to improve system software security. It argues for greater investment in security audits, open-source software development, and static and dynamic checks, while noting that changing languages or specifications is unlikely in the near term. ### Source excerpt The strong reactions about the recent OpenSSL bug are understandable: it is not fun when suddenly all the internet needs to be patched. Moreover for me personally how trivial the bug is, is disturbing. I don't want to point the finger to the OpenSSL developers, but you just usually think at those class of issues as a bit more subtle, in the case of a software like OpenSSL. Usually you fail to do sanity checks *correctly*, as opposed to this bug where there is a total *lack* of bound checks in the memcpy() call. However sometimes in the morning I read the code I wrote the night before and I'm deeply embarrassed. Programmers sometimes fail, I for sure do often, so my guess is that what is needed is a different process, and not a different OpenSSL team. There is who proposes a different language safer than C, and who proposes that the specification is broken because it is too complex. Probably there is some truth in both arguments, however it is unlikely that we move to a different specification or system language soon, so the real question is, what we can do now to improve system software security? 1) Throw money at it. Making system code safer is simple if there are investments. If different companies hire security experts to do code auditings in the OpenSSL code base, what happens is that the probability of discovering a bug like heartbleed is greater. I've seen very complex bugs that are triggered by a set of non-trivial conditions being discovered by serious code auditing efforts. A memcpy() without bound checks is something that if you analyze the code security-wise, will stand out in the first read. And guess how heartbleed was discovered? Via security auditings performed at Google. Probably the time to consider open source something that mostly we take from is over. Many companies should follow the example of Google and other companies, using workforce for OSS software development and security. 2) Static and dynamic checks. Static code analysis is, as a side ef