Static Analysis
The process of analyzing source code without executing it to find potential bugs, security vulnerabilities, and code quality issues.
Definition
Static analysis examines code structure, data flow, and patterns to detect issues before runtime. Unlike dynamic analysis (which runs the code), static analysis can check all code paths, including error handling that rarely executes. Tools range from simple linters (ESLint, Pylint) to advanced security scanners (Semgrep, SonarQube) and AI-powered reviewers (diffray).
Why It Matters
Static analysis catches bugs 10-100x cheaper than finding them in production. It's particularly effective for security vulnerabilities, as it can detect issues like SQL injection patterns before any code runs. According to NIST, fixing a bug in production costs 30x more than fixing it during development.
Example
A static analyzer scans code and detects that a variable could be null when accessed, flagging a potential NullPointerException before the code is even run.