What is static code analysis?

Also known as source code analysis, static code analysis identifies logical errors and memory leaks before applications are executed, reducing debugging time. It automatically scans for syntax errors and hidden security vulnerabilities humans might miss. It enforces coding standards and helps ensure regulatory compliance across large teams and generally speeds up development overall.

Static code analysis, as opposed to dynamic code analysis, happens before code is executed. Dynamic analysis involves running the application and observing its behavior. In contrast, static analysis treats source code as a structural dataset, which it scans to identify issues before the application is ever compiled, packaged or deployed. This approach models how the program will behave based on its structure. Both techniques are important for an overall quality assurance practice within a devops or devsecops framework.

There are three primary stages involved in static code analysis.

The analyzer reads source code and breaks it down into tokens. These are fed into a parser that evaluates them against the grammar rules of a specific programming language and restructures them into a hierarchical abstract syntax tree (AST). The AST maps the structure of the software in a machine-readable format.

The analyzer constructs a control flow graph (CFG) to map execution paths, combined with data flow analysis to track how variables change values from initialization to usage. This is the stage where the analyzer might discover errors like dead code (code that can never be executed).

Using the AST and flow models, the tool checks the code against coding guidelines and heuristics. These range from simple naming conventions to more sophisticated security checks like taint analysis, which tracks tainted user inputs that could lead to SQL injections.

In the earliest days of computing, code execution was expensive, and developers couldn’t afford to waste compute debugging. Verification was entirely driven by human intelligence, with slow and manual code reviews.

The 1978 creation of Lint by Stephen C. Johnson at Bell Labs marks the beginning of modern static code analysis. Lint was developed for the Unix operating system and was designed to scan source code and flag suspicious constructions before compilation.

Lint pinpointed problematic code for removal without changing the program’s logic, which saved valuable compute. Johnson named Lint after the fluff caught in a clothes dryer trap because his tool stripped away unwanted problematic code (lint) without changing the logic (the structure of the clothing).

As the internet grew throughout the 1990s and 2000s, so did the need to mitigate security flaws. New tools emerged to meet this demand, as did more complex forms of analysis that compiled code into mathematical models to track how variables moved. New frameworks like static application security testing (SAST) emerged to counter these threats, while methods like dynamic application security testing (DAST) enabled runtime evaluation.

While mathematically precise, these techniques suffered from high false-positive rates due to their inabbecause of their limited ability to understand context. The rise of machine learning and large language models (LLMs) in the 2020s triggered a new era of code analysis, where models could be trained with billions of lines of code. This training gave them the ability to infer developer intent and semantic context.

Traditionally, static code analysis was a gatekeeper process run before release, but today, this analysis is performed throughout the software development lifecycle (SDLC). This “shift left” philosophy involves moving testing “leftward,” closer to the creation of the code.

Today, code analysis tools like SonarQube, ESLint and GitHub Advanced Security are an integral part of the developer’s workflow. They run inside integrated development environments (IDEs) to flag errors in real time as a developer types. They also act as automated checkpoints within continuous integration and continuous deployment, or CI/CD pipelines.

Modern coding assistants powered by machine learning have enabled decentralized code analysis that’s fast and largely invisible, enabling developers to catch errors early and improve code quality in real time. IBM Bob, for example, has a “Review” workflow that runs in a separate panel and automatically looks for code smells and flags coding standards violations, which users can then dismiss or have Bob automatically resolve.

Analysis can also be done proactively through strategic prompting. For example, rather than asking a coding assistant to “find bugs,” a developer can ask it to review repositories with specific goals in mind. For architecture review, one can ask it to review directory organization, entry points, component relationships and the overall tech stack—all generating detailed documentation. A prompt analyzing database design can identify modernization goals. Specialized prompts can review database design, migration analysis and perform a comprehensive review of technical debt, with recommendations on how to most strategically remediate issues.