Social Media Ideas for Static Analysis

Static Application Security Testing (SAST)

There are 755 static-analysis tools. Only 42 are open-source security scanners.

If you run a linter on your code today, you have a lot of choices. If you want one that actually looks for security bugs — and is open source — you have far fewer than the ecosyste...

AI SAST: Code Security for the Agentic SDLC

Endor Labs has launched an AI-powered Static Application Security Testing (SAST) tool for C code that detects more vulnerabilities than traditional scanners without requiring a sof...

Why DAST Findings Are Hard to Fix and How to Make Them Actionable

Dynamic testing is essential because it uncovers vulnerabilities in running applications. But while SAST gets the attention because it’s shift-left and relatively straightforward t...

The Halting Problem’s Quiet Relevance to Static Analysis Tools

Why your linter can never be complete, and why that is not a bug in the tool but a theorem about computation itself. Every developer has had the same two-part argument with a linte...

Audition is a linter/fixer that gets your code Ractor-ready

Vibe coded a useful thing for Rubyists over the weekend. Audition is a linter/fixer that gets your code Ractor-ready: static analysis powered by Shopify’s rubydex, plus dynamic pro...

Мост между SAST и фаззингом: как из сработки SAST получить подтверждённую уязвимость

Инструменты статического анализа (SAST) лишь подсвечивают вероятные уязвимости, генерируя гипотезы. Динамическое тестирование (DAST) и фаззинг, напротив, выявляют реальные сбои на...

We Built a Security Scanner That Automates Itself — and Never Touches the Cloud

How AI Security Studio's ASS Script engine lets you record, replay, and narrate a full offline security scan — deterministic analysis first, local LLM reasoning second. Most "AI-...

I ran my Solidity scanner on 6 top-audited DeFi protocols. Every 'critical' was a false positive — here's why.

Most Solidity scanners are high-recall, low-precision. They flag 40 things, 38 are noise, and after the third report you stop reading them — so the one real bug ships. Precision, n...

Introducing Rubydex linter: structural checks for Ruby projects

Originally appeared on Rails at Scale. What is Rubydex linter Rubydex is a static analysis toolkit for Ruby. My teammate Vini introduced it in more detail in One engine, many too...

Проверка исходников VSCode

Теперь можно говорить без всяких прикрас: мы выпустили анализатор для языков JavaScript и TypeScript. А значит, это повод испытать его в полевых условиях и посмотреть, что он найдё...

Как внедрить требования к безопасной разработке кода: опыт Staffcop

Безопасная разработка для Staffcop (системы расследования инцидентов внутренней инфобезопасности) — это не отдельная проверка перед релизом, а процесс, который команда постепенно в...

Automate Tech Debt Audits with Claude Code

Over the years, we have written about many of the tools we use: Skunk for combining code quality and code coverage data, bundler-audit for security vulnerabilities in your dependen...

The Bytecode Verifier’s Hidden Contract

Every class file passes a formal dataflow analysis before the JIT ever sees it, and that quiet checkpoint is what actually makes the JVM’s sandbox model possible. Ask most Java dev...

Композиционный анализ проектов на C++

Композиционный анализ (Software Composition Analysis, SCA) – это практика автоматического выявления и отслеживания внешних зависимостей проекта с целью мониторинга их известных уяз...

What Is Static Testing: Its Features And Best Practices

Static testing, a non-execution method, reviews code for errors, enhancing quality and preventing issues before execution.

Black Duck Extends Scope and Reach of Code Scanning Tool

Black Duck has updated its Coverity static analysis code scanning tool to provide deeper integrations with artificial intelligence (AI) tools along with updates to its user interfa...

I Built a Security Linter for AI-Generated Code, Here Is What I Found in a Real Production Codebase

AI coding tools write fast. GitHub Copilot. Cursor. ChatGPT. Claude. Gemini. Every single one of them is now inside production codebases at companies worldwide. And every single...

Who Vets AI’s Code? The Scale Challenge Facing Open Source Ingestion

AI coding tools can introduce unvetted or hallucinated open source dependencies faster than traditional security reviews can keep pace. ActiveState explains why organizations shoul...