Static analysis (programming)

Static analysis is the automated examination of source code without executing it, hunting for bugs, security flaws, and style violations before a program ever runs. Unlike dynamic testing, which probes behavior through execution, static analyzers read code as text and apply logical rules—pattern matching, Data structure traversal, and logical inference—to predict problems.

These tools scan for common pitfalls: null pointer dereferences, unreachable code, type inconsistencies, and potential security vulnerabilities. They power linters, which enforce coding standards, and sophisticated analyzers that perform formal verification or causal reasoning about program flow.

Static analysis shines in safety-critical domains—aviation, medicine, autonomous vehicles—where bugs are catastrophic. Modern compilers embed it. Tools like Pylint, ESLint, and Clang Static Analyzer have become indispensable to software teams.

The tradeoff is inherent: without running the code, analyzers must be conservative, often flagging false positives. Sound analysis (catching all real bugs) typically demands accepting some noise. Developers balance precision against practical tolerance for false warnings.

Related

Code review, Type system, Software testing, Debugging, Program analysis, Security (computing)