#static-code-analysis

Detekt Explained: Enhance Kotlin Projects with Static Analysis — part 1

This article was originally published on wilfried.hashnode.dev

Integrating Endevor CAST with SonarQube

Integrating a SonarQube code-quality gate into Endevor Package CAST actions offers a seamless and efficient way to enforce code quality…

Bugs and suspicious code fragments in .NET 10

A little over six months ago, .NET 10 was released. Have any defects remained in the project’s source code after all these months? Let’s…

Real-world C++ projects built with GenAI: do they exist?

To keep PVS-Studio sharp against whatever new patterns of bugs vibe coding introduces, I’ve been hunting for real open-source C++ projects…

Understanding AI-Native Security (Part 3)

Dataflow Analysis: When Pattern Matching Isn’t Enough

Membangun Sistem Analisis Kualitas yang Berlapis untuk Aplikasi Medis

Dalam pengembangan aplikasi klinis, kualitas kode bukan sekadar best practice, melainkan sebagai penyelamat. Satu bug pada modul enkripsi…

Static code analysis and software time to market

This article focuses on the methodology of static code analysis and its role in streamlining the time to market for software products…

Static vs Dynamic Website — Which One Should You Choose?

In today’s digital world, having a website is essential for every business. Whether you own a startup, local shop, educational institute…

Reverse Engineering & Code Analysis

Reverse engineering is basically the art of taking a program apart to see how it really works under the hood. When you don’t have the…

How to Build a World-Class SAST Program from Scratch

A practitioner’s guide to transforming static analysis security testing — from creating the vision to selecting the right tools through…

I Built a dnSpy MCP So Claude Code Can Reverse-Engineer .NET Binaries Autonomously

How I solved dnSpy’s piped-stdout crash, shipped 10 analysis tools as an MCP server, and used it to find SQL injection in a thick client…

Why We Believe What We Want to Hear About Our Code

In 1948, psychologist Bertram Forer gave his students a personality assessment and then handed each of them what he said was their…

🐍 When Static Analysis Turns Dangerous: Command Injection in NASA’s Cobra Tool

What is Cobra?

Airflow 3 Migration with Ruff: How Static Code Analysis Can Help Code Migration at Scale

Statik Kod Analiz Metadolojisi ve Güvenlik Stratejileri

Yazılım geliştirme süreçlerinde ortaya çıkarılan uygulamalarının amaçlarına yönelik ve hatasız çalışabilmesi için bu uygulamanın…

The Hitchhiker’s Guide to LTS: Key changes when upgrading from Java 8 to Java 11

This is the first article in a series on what developers can expect when upgrading between LTS versions of Java. In this part, we’ll look…

Understanding Static Analysis Limits in Modern Malware Detection

A file doesn’t need to execute to trigger analysis.

“BombLab Static Analysis Walkthrough”

A Step-by-Step Guide to Reverse Engineering with Ghidra

How to integrate SonarQube / SonarCloud)…

…for free without loosing control over my code

Static vs. Dynamic Code Analysis: How RuboCop Reads Ruby’s Mind

Explore the key differences between static and dynamic analysis — and discover how RuboCop inspects your code’s Abstract Syntax Tree (AST)…

Dynamic vs Static QR Codes: Which One to Choose? — Visu Network

Introduction

How to get and use free PVS-Studio license. Part 1: Preparing and getting started

Many developers have heard of PVS-Studio static analyzer, but not everyone knows they can use it for free on a permanent basis. This…

Use PVS-Studio to analyze open-source projects

Want to make your open-source project cleaner and more secure? This post shows how to use PVS-Studio for regular code analysis, integrate…

How we integrate best practices in Java

This is a story of rewriting an application for DI containers, parsing dependencies, drawing schemas to avoid getting lost, and quietly…

Predecessor and Dominator Phis

Here, I discuss several styles of phi nodes and my way to create SSA from an AST.

Using AI to Reverse Engineer Code and Derive Requirements

Can AI understand legacy code with zero comments, tests, or README?

How to Analyze Your GitHub Code Quality with SonarQube and Docker

A step-by-step guide to setting up SonarQube locally and scanning your code in under 10 minutes

Splint as a Static Bug Detection Tool for C

Most C compilers stop at syntax and type checking — but Splint goes deeper, uncovering logic flaws and subtle memory issues at compile…

Copy-paste on big screen. Analyzing errors and oddities in Radarr code

Writing the same thing over and over again is an incredibly tedious endeavor! That’s why programmers often resort to copy-pasting. While it…

How to Reduce Cyclomatic Complexity?

This blog was originally published in the Typo blog.

Unlock Cleaner Code in Vue and Nuxt Projects with Vue Mess Detector

Does code quality matter? For computers, it usually doesn’t. But for us, the developers, it certainly does. If we neglect to write clean…

The Power of Code Review: How Static Code Analysis Tools Enhance Software Quality

Introduction

Code Coverage and Static code Analylizer

Code coverage is a metric that can help you understand how much of your source is tested. (atlassian.com)

The Ultimate SAST Cheat Sheet for Developers

Introduction

SonarQube Community Edition: Comprehensive guide for a free personal setup

Supercharge your code with SonarQube!

Static Code Analysis: Your Secret Weapon for Flawless Software

Ensure your code is of the highest quality and free of defects with static code analysis. Improve the reliability and performance of your..