Code Analysis

Code Analysis is the automated, systematic examination of source code (static) or runtime behavior (dynamic) to identify security vulnerabilities, bugs, and compliance violations.

This technology is a critical DevSecOps component: it finds flaws before they hit production. Static Analysis (SAST) tools, like SonarQube or Snyk, scan non-running code to catch issues such as SQL injection or buffer overflows. Dynamic Analysis (DAST) tests running applications to uncover runtime errors or performance bottlenecks. By integrating these checks into the CI/CD pipeline, teams automate quality gates; they enforce coding standards (e.g., MISRA) and significantly reduce technical debt, ensuring a cleaner, more secure codebase from the initial commit.

https://owasp.org/www-community/Static_Code_Analysis