static-analysis
Safeguard articles tagged "static-analysis" — guides, analysis, and best practices for software supply chain and application security.
170 articles
What Does SAST Stand For, Exactly?
SAST stands for static application security testing — analyzing source code for vulnerabilities without ever running the program, which is what separates it from every dynamic testing approach.
Semgrep vs CodeQL: Static Analysis for Security Teams
A deep comparison of Semgrep and CodeQL for static application security testing, covering rule writing, performance, language support, and practical deployment considerations.
SonarQube Security Scanning: Code Quality Meets Application Security
A review of SonarQube's security scanning capabilities, examining how its code quality heritage shapes its approach to vulnerability detection and taint analysis.
Kotlin detekt Security Rules: Catching Vulnerabilities in Kotlin Code
detekt is Kotlin's primary static analysis tool. Its security-relevant rules catch patterns that lead to vulnerabilities in Android and server-side Kotlin.
SpotBugs Security Detectors for Java: A Practical Guide
SpotBugs with Find Security Bugs is the most effective free security analysis tool for Java. Here is how to get real results from it.
Swift Security Analysis Tools: The Current Landscape
Swift's type safety helps, but it does not eliminate all security bugs. Here is the current tooling landscape for finding vulnerabilities in Swift code.
gosec: Static Analysis for Go Security
gosec is the standard security linter for Go. Here is what it catches, what it misses, and how to integrate it effectively into your workflow.
PHPStan Security Analysis: Static Typing as a Security Tool for PHP
PHPStan brings static analysis to PHP. Its type checking catches entire classes of bugs that lead to security vulnerabilities in PHP applications.
Runtime vs Static Container Analysis: Complementary, Not Competing
Static scanning finds known vulnerabilities. Runtime analysis finds actual exploitation. Using only one gives you half the picture.
Taming Static Analysis: A Practical Guide to False Positive Reduction
False positives kill SAST adoption faster than anything else. Here is how to cut through the noise without missing real vulnerabilities.
Bandit for Python Security Linting: Getting Real Value From Static Analysis
Bandit scans Python code for security issues. Here is how to configure it so it catches real bugs without burying your team in false positives.
GoSec Static Analysis for Go: Practical Security Scanning
GoSec finds security issues in Go source code. Here is how to get the most out of it without fighting false positives all day.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.