Zarn is a lightweight Perl static security analysis tool using AST inspection and taint tracking to identify possible vulnerabilities.
Read more
Tag: static analysis
checkglobals – R package that performs static analysis of R source code dependencies
checkglobals is an R package that performs static analysis of R source code dependencies.
Read more
PHPCompatibility – coding standard for PHP_CodeSniffer
PHPCompatibility is a coding standard for PHP_CodeSniffer that helps developers check PHP source code for cross-version compatibility.
Read more
PHPArkitect – define architectural rules as executable PHP code
PHPArkitect is a command line tool for PHP projects that lets developers define architectural rules as executable PHP code.
Read more
Deptrac – static code analysis tool for PHP projects
Deptrac is a static code analysis tool for PHP projects that helps developers define, communicate, and enforce architectural rules.
Read more
Phan – static analyzer for PHP
Phan is a static analyzer for PHP designed to find problems in code without executing it.
Read more
Splint – Clojure linter for style and code shape
Splint is a configurable Clojure linter for code style, naming, complexity and performance, with custom rules and autocorrection.
Read more
Include What You Use – source analysis tool
Include What You Use analyses C and C++ header dependencies, identifies missing or unnecessary includes and suggests cleaner declarations.
Read more
gosec – Go Security Checker
gosec scans Go source for security problems using AST, SSA and taint analysis, with SARIF output, CI integration and a broad rule set.
Read more
flowR – sophisticated, static dataflow analyzer
flowR is a sophisticated static analysis framework for the R programming language.
Read more
go-critic – opinionated Go source code linter
go-critic is an extensible Go linter with almost 100 checks for bugs, performance, diagnostics and opinionated source-code improvements.
Read more
Error Prone – detect Java programming mistakes at compile time
Error Prone integrates with Java compilation to detect common coding mistakes, apply configurable checks and suggest automated fixes.
Read more
Checkstyle – enforce Java coding standards
Checkstyle enforces Java coding standards through configurable rules covering formatting, imports, naming, Javadoc and class design.
Read more
Checker Framework – pluggable type checking for Java
Checker Framework adds pluggable type checking to Java, detecting nullness, initialization, type qualifier and data-flow errors.
Read more
NullAway – fast null pointer error detection for Java
NullAway finds potential Java null pointer errors during compilation using nullability annotations and fast Error Prone analysis.
Read more
PMD – extensible cross-language static code analyser
PMD examines Java and other source code for defects, code smells and duplication, using configurable rules and custom checks.
Read more
SpotBugs – static analysis tool for finding Java bugs
SpotBugs detects potential bugs in compiled Java code, including null dereferences, bad API usage and concurrency problems.
Read more
kibit – static code analyzer for Clojure
kibit analyses Clojure source code and recommends simpler, more idiomatic expressions, with optional automatic fixes and reporting.
Read more
Eastwood – Clojure lint tool
Eastwood is a compiler-aware Clojure linter that detects suspicious expressions, incorrect calls, deprecated APIs and unused code.
Read more
clang-tidy – Clang-based C and C++ linter
clang-tidy detects C and C++ bugs, style problems and modernisation opportunities with configurable checks and automatic fixes.
Read more