Static analysis is the technique of analyzing code without executing it — examining source code, bytecode, or intermediate representations to detect bugs, security vulnerabilities, code quality issues, and verify properties, all without running the program.

What Is Static Analysis?

<svg viewBox="0 0 760 470" xmlns="http://www.w3.org/2000/svg" font-family="-apple-system,Segoe UI,Roboto,sans-serif">
  <rect x="0" y="0" width="760" height="470" fill="#0d1117"/>
  <text x="380" y="28" fill="#e6edf3" font-size="21" font-weight="700" text-anchor="middle">Static Analysis — Finding Bugs Without Running Code</text>
  <text x="380" y="48" fill="#8b98a5" font-size="12" text-anchor="middle">examine source/bytecode at compile time to detect defects, vulnerabilities, and style violations</text>

  <!-- Analysis pipeline -->
  <rect x="30" y="65" width="700" height="135" rx="6" fill="#080d14" stroke="#233043" stroke-width="1"/>
  <text x="380" y="84" fill="#e6edf3" font-size="11" font-weight="600" text-anchor="middle">Static Analysis Pipeline</text>

  <!-- Source code -->
  <rect x="50" y="100" width="100" height="70" rx="4" fill="#0b1220" stroke="#60a5fa" stroke-width="1"/>
  <text x="100" y="118" fill="#93c5fd" font-size="9" font-weight="600" text-anchor="middle">Source Code</text>
  <text x="100" y="136" fill="#6b7684" font-size="7.5" text-anchor="middle">C/C++/Java/</text>
  <text x="100" y="150" fill="#6b7684" font-size="7.5" text-anchor="middle">Python/Go</text>
  <text x="100" y="164" fill="#6b7684" font-size="7" text-anchor="middle">or bytecode</text>

  <path d="M152,135 L180,135" fill="none" stroke="#3a4453" stroke-width="1"/>
  <polygon points="178,132 184,135 178,138" fill="#3a4453"/>

  <!-- Parse/AST -->
  <rect x="187" y="100" width="95" height="70" rx="4" fill="#0b1220" stroke="#a78bfa" stroke-width="1"/>
  <text x="234" y="118" fill="#c4b5fd" font-size="9" font-weight="600" text-anchor="middle">Parse → AST</text>
  <text x="234" y="136" fill="#8b98a5" font-size="7.5" text-anchor="middle">control flow graph</text>
  <text x="234" y="150" fill="#8b98a5" font-size="7.5" text-anchor="middle">data flow graph</text>
  <text x="234" y="164" fill="#6b7684" font-size="7" text-anchor="middle">call graph</text>

  <path d="M284,135 L312,135" fill="none" stroke="#3a4453" stroke-width="1"/>
  <polygon points="310,132 316,135 310,138" fill="#3a4453"/>

  <!-- Analysis engine -->
  <rect x="319" y="100" width="140" height="70" rx="4" fill="#0b1220" stroke="#f59e0b" stroke-width="1.2"/>
  <text x="389" y="118" fill="#fbbf24" font-size="9" font-weight="600" text-anchor="middle">Analysis Engine</text>
  <text x="389" y="136" fill="#8b98a5" font-size="7.5" text-anchor="middle">abstract interpretation</text>
  <text x="389" y="150" fill="#8b98a5" font-size="7.5" text-anchor="middle">pattern matching</text>
  <text x="389" y="164" fill="#8b98a5" font-size="7.5" text-anchor="middle">taint tracking</text>

  <path d="M461,135 L489,135" fill="none" stroke="#3a4453" stroke-width="1"/>
  <polygon points="487,132 493,135 487,138" fill="#3a4453"/>

  <!-- Results -->
  <rect x="496" y="100" width="100" height="70" rx="4" fill="#0b1220" stroke="#f87171" stroke-width="1"/>
  <text x="546" y="118" fill="#fca5a5" font-size="9" font-weight="600" text-anchor="middle">Findings</text>
  <text x="546" y="136" fill="#8b98a5" font-size="7.5" text-anchor="middle">bugs, vulns</text>
  <text x="546" y="150" fill="#8b98a5" font-size="7.5" text-anchor="middle">+ line numbers</text>
  <text x="546" y="164" fill="#6b7684" font-size="7" text-anchor="middle">+ fix suggestions</text>

  <path d="M598,135 L626,135" fill="none" stroke="#3a4453" stroke-width="1"/>
  <polygon points="624,132 630,135 624,138" fill="#3a4453"/>

  <!-- CI integration -->
  <rect x="633" y="100" width="80" height="70" rx="4" fill="#14261f" stroke="#34d399" stroke-width="1"/>
  <text x="673" y="118" fill="#6ee7b7" font-size="9" font-weight="600" text-anchor="middle">CI Gate</text>
  <text x="673" y="138" fill="#34d399" font-size="8" text-anchor="middle">pass/fail</text>
  <text x="673" y="155" fill="#6b7684" font-size="7" text-anchor="middle">block merge</text>
  <text x="673" y="168" fill="#6b7684" font-size="7" text-anchor="middle">if new bugs</text>

  <!-- Bug categories -->
  <rect x="30" y="212" width="345" height="168" rx="6" fill="#080d14" stroke="#233043" stroke-width="1"/>
  <text x="202" y="232" fill="#e6edf3" font-size="10" font-weight="600" text-anchor="middle">What Static Analysis Finds</text>

  <text x="50" y="256" fill="#f87171" font-size="8.5" font-weight="600">Memory bugs:</text>
  <text x="145" y="256" fill="#8b98a5" font-size="8">null deref, buffer overflow, use-after-free, leaks</text>

  <text x="50" y="276" fill="#f59e0b" font-size="8.5" font-weight="600">Concurrency:</text>
  <text x="140" y="276" fill="#8b98a5" font-size="8">data races, deadlocks, atomicity violations</text>

  <text x="50" y="296" fill="#a78bfa" font-size="8.5" font-weight="600">Security:</text>
  <text x="118" y="296" fill="#8b98a5" font-size="8">SQL injection, XSS, path traversal (taint analysis)</text>

  <text x="50" y="316" fill="#60a5fa" font-size="8.5" font-weight="600">Logic:</text>
  <text x="95" y="316" fill="#8b98a5" font-size="8">dead code, unreachable, redundant conditions</text>

  <text x="50" y="336" fill="#34d399" font-size="8.5" font-weight="600">Type:</text>
  <text x="92" y="336" fill="#8b98a5" font-size="8">type confusion, unchecked casts, missing generics</text>

  <text x="50" y="358" fill="#6b7684" font-size="8">false positive rate: 15–40% (trade-off with coverage)</text>
  <text x="50" y="372" fill="#6b7684" font-size="7.5">soundness: over-approximate → may report impossible bugs (safe side)</text>

  <!-- Tools panel -->
  <rect x="390" y="212" width="340" height="168" rx="6" fill="#080d14" stroke="#233043" stroke-width="1"/>
  <text x="560" y="232" fill="#e6edf3" font-size="10" font-weight="600" text-anchor="middle">Tools &amp; Ecosystem</text>

  <text x="410" y="256" fill="#60a5fa" font-size="8.5" font-weight="600">C/C++:</text>
  <text x="458" y="256" fill="#8b98a5" font-size="8">Coverity, CodeQL, Infer, clang-tidy, Polyspace</text>

  <text x="410" y="276" fill="#34d399" font-size="8.5" font-weight="600">Java:</text>
  <text x="448" y="276" fill="#8b98a5" font-size="8">SpotBugs, ErrorProne, PMD, SonarQube</text>

  <text x="410" y="296" fill="#a78bfa" font-size="8.5" font-weight="600">Python:</text>
  <text x="462" y="296" fill="#8b98a5" font-size="8">mypy, pytype, Bandit, Ruff, Pylint</text>

  <text x="410" y="316" fill="#f59e0b" font-size="8.5" font-weight="600">Multi-lang:</text>
  <text x="480" y="316" fill="#8b98a5" font-size="8">Semgrep, CodeQL (GitHub), Snyk Code</text>

  <text x="410" y="340" fill="#f87171" font-size="8.5" font-weight="600">AI-powered (2024+):</text>
  <text x="410" y="356" fill="#8b98a5" font-size="8">LLM + static analysis hybrid (Amazon CodeGuru,</text>
  <text x="410" y="370" fill="#8b98a5" font-size="8">Qodo, GitHub Copilot code scanning)</text>

  <!-- Footer -->
  <text x="380" y="410" fill="#8b98a5" font-size="8.5" text-anchor="middle">static analysis catches bugs at commit time — 100× cheaper than finding them in production</text>

  <text x="380" y="452" fill="#6b7684" font-size="11" text-anchor="middle">Static analysis is the first line of defense — it finds entire classes of bugs before a single test runs.</text>
</svg>

• Static: Analysis performed on code at rest — no execution required.
• Automated: Tools automatically scan code to find issues.
• Scalable: Can analyze large codebases quickly.
• Early Detection: Finds bugs during development, before code runs.

Why Static Analysis?

• Find Bugs Early: Detect issues before code reaches production — cheaper to fix.
• No Test Cases Needed: Unlike testing, doesn't require writing tests or generating inputs.
• Comprehensive: Can analyze all code paths, including rare or hard-to-test scenarios.
• Security: Find vulnerabilities that could be exploited — SQL injection, buffer overflows, etc.
• Code Quality: Enforce coding standards, detect code smells, improve maintainability.

Types of Static Analysis

• Syntactic Analysis: Check code structure and syntax.
• Parsing, syntax checking, style enforcement.
• Tools: linters (ESLint, Pylint, RuboCop).

• Type Checking: Verify type correctness.
• Ensure variables are used consistently with their types.
• Tools: TypeScript, MyPy, Flow.

• Data Flow Analysis: Track how data flows through the program.
• Detect uninitialized variables, unused values, null pointer dereferences.
• Tools: FindBugs, SpotBugs, Infer.

• Control Flow Analysis: Analyze program control flow.
• Detect unreachable code, infinite loops, missing return statements.

• Taint Analysis: Track untrusted data flow.
• Detect when user input reaches sensitive operations without sanitization.
• Find SQL injection, XSS, command injection vulnerabilities.

• Abstract Interpretation: Soundly approximate program behavior.
• Prove absence of certain bug classes.
• Tools: Astrée, Polyspace.

Common Bug Types Detected

• Null Pointer Dereferences: Accessing null/None objects.
• Buffer Overflows: Writing beyond array bounds.
• Resource Leaks: Not closing files, connections, or freeing memory.
• Concurrency Bugs: Race conditions, deadlocks, data races.
• Security Vulnerabilities: Injection attacks, authentication bypasses, crypto misuse.
• Logic Errors: Unreachable code, infinite loops, incorrect conditions.
• Code Quality Issues: Dead code, duplicated code, overly complex functions.

Example: Static Analysis Detecting Bugs

# Bug 1: Null pointer dereference
def process_user(user):
    return user.name.upper()  # What if user is None?

# Static analysis warning: "user may be None"

# Bug 2: Resource leak
def read_file(filename):
    f = open(filename)
    data = f.read()
    return data  # File never closed!

# Static analysis warning: "Resource leak: file not closed"

# Bug 3: SQL injection
def get_user(username):
    query = f"SELECT * FROM users WHERE name = '{username}'"
    return execute_query(query)

# Static analysis warning: "SQL injection vulnerability: unsanitized user input"

Static Analysis Techniques

• Pattern Matching: Look for known bug patterns.
• Example: if (x = 5) instead of if (x == 5) — assignment in condition.

• Type Inference: Infer types and check consistency.
• Example: Detect when a function expecting int receives string.

• Symbolic Execution: Explore paths symbolically without concrete values.
• Example: Determine if null check is missing on a path.

• Abstract Interpretation: Compute abstract values representing sets of concrete values.
• Example: Track that a variable is "positive" or "possibly null."

• Model Checking: Verify properties against a model of the program.
• Example: Prove that a lock is always released.

Static Analysis Tools

• General Purpose:
• SonarQube: Multi-language code quality and security analysis.
• Coverity: Commercial static analyzer for C/C++, Java, C#.
• Fortify: Security-focused static analysis.

• Language-Specific:
• Pylint / Flake8 (Python): Style and bug detection.
• ESLint (JavaScript): Linting and bug detection.
• RuboCop (Ruby): Style and bug detection.
• FindBugs / SpotBugs (Java): Bug detection.
• Clang Static Analyzer (C/C++): Bug detection.

• Security-Focused:
• Bandit (Python): Security issue detection.
• Brakeman (Ruby on Rails): Security vulnerability scanner.
• Semgrep: Pattern-based security and bug detection.

Soundness vs. Completeness

• Sound Analysis: Never misses bugs (no false negatives) — but may report false positives.
• Conservative: Reports potential bugs even if uncertain.
• Example: Abstract interpretation tools.

• Complete Analysis: Never reports false positives — but may miss bugs (false negatives).
• Optimistic: Only reports definite bugs.
• Most practical tools are incomplete.

• Trade-Off: Sound tools have many false positives (noise). Complete tools miss bugs. Most tools balance between the two.

Challenges

• False Positives: Reporting bugs that don't exist — developers ignore warnings if too many false positives.
• False Negatives: Missing real bugs — no tool finds all bugs.
• Scalability: Analyzing large codebases can be slow.
• Precision: Balancing precision (few false positives) with recall (few false negatives).
• Undecidability: Some properties are undecidable — perfect analysis is impossible.

LLMs and Static Analysis

• Bug Detection: LLMs can identify bug patterns in code.
• False Positive Reduction: LLMs can help filter false positives from static analyzers.
• Explanation: LLMs can explain why code is flagged and how to fix it.
• Custom Rules: LLMs can help developers write custom analysis rules.

Applications

• Continuous Integration: Run static analysis on every commit — catch bugs early.
• Code Review: Automated pre-review to catch obvious issues.
• Security Audits: Find vulnerabilities before deployment.
• Compliance: Ensure code meets standards (MISRA C, CERT C, etc.).
• Refactoring: Identify code smells and improvement opportunities.

Benefits

• Early Bug Detection: Find bugs before testing or deployment.
• No Execution Needed: Analyze code that's hard to test or run.
• Comprehensive Coverage: Analyze all code paths, not just tested ones.
• Automated: Requires minimal human effort once set up.

Limitations

• Cannot Find All Bugs: Some bugs require runtime information or complex reasoning.
• False Positives: Can report non-issues, leading to alert fatigue.
• Configuration: Requires tuning to balance precision and recall.

Static analysis is a fundamental software engineering practice — it provides automated, scalable bug detection that complements testing and code review, improving code quality and security throughout the development lifecycle.