Static Analysis

Static analysis refers to examining a program without actually running it, in contrast to dynamic analysis, which requires actually executing code to observe behavior.

AI-assisted testing can generate test scenarios, summarize execution traces, analyze screenshots, identify suspicious patterns in logs, and infer failure causes, but diagnoses are only hypotheses until verified by an engineer.

GitNexus在构建知识图谱时执行多层次静态分析：语法层面通过AST解析，语义层面通过符号解析追踪跨文件引用，模块层面分析import/require/include依赖声明

Static analysis and automated scanning tools have long faced the problem of high false positive rates.

At runtime, REVA injects three types of precomputed information into the LLM: a precomputed threat model for the module in question, lightweight static analysis findings, and call graph information.

Static analysis tools scan source code without running the program, identifying common vulnerability patterns such as injection attacks, insecure default configurations, and hardcoded secrets.

Automated verification gates should be designed as "intercept and hand off to human review" rather than unconditional blocking, to avoid false positives slowing down low-risk changes.

Traditional code review and static analysis tools (such as linters) are good at finding syntax errors, code style issues and pattern-based defects, but know nothing about runtime behavior.

Traditional static analysis tools (such as ESLint, SonarQube, and Semgrep) face new problems in AI coding scenarios: the volume of AI-generated code far exceeds the speed of manual writing, and styles and patterns are highly diverse, making rule-based checks prone to misses.

Intermediate applications such as AI-assisted code auditing and LLM-based static analysis are in an early deployment stage, and their effectiveness varies by scenario.

Type systems turn some runtime errors into compile-time errors through mechanisms such as algebraic data types and immutability; static analysis uses data-flow analysis and abstract interpretation to detect patterns such as null pointers and resource leaks.

Static analysis tools and runtime detection (such as ThreadSanitizer) can compensate for the unintuitive aspects of concurrency models.

The benefit of contracts for static analysis is not free; the premise is that the analysis tool can be certain that the contract will actually be checked at runtime or be treated as inviolable, otherwise false positives or false negatives will occur.

Contracts can serve as input to static analysis tools; even if runtime checks are disabled, the tool can still infer potential null pointer dereferences or array out-of-bounds based on the condition declarations.

Runtime verification can catch problems that static analysis cannot find, such as database transaction deadlocks, duplicate consumption in message queues, state inconsistency after external API timeouts, and race conditions under concurrency.

By default, bundlers only include in the output modules that can be statically identified as being referenced; dynamically concatenated module names, conditional loading, and packages that plugins import on demand at runtime may all be misjudged as unused and removed

The advantages of static analysis are that it is fast, reproducible, and deterministic, and does not rely on a sandbox environment; the cost is that it cannot discover problems that only surface at runtime, such as crashes from type errors, asynchronous timing issues, or differences in API behavior under specific versions.

Because the evaluation does not execute the code, a build plan that passes static analysis may still fail at runtime.

Static analysis tools, without running the code, discover potential issues by parsing the abstract syntax tree (AST) and building data flows; their advantage is speed and automation, but the cost is a lack of runtime context, which easily produces false positives.

Tools like Deslop typically need to trade off between rule strictness and false positive rate: the more aggressive the rules, the more redundancy they can clean up, but the more likely they are to flag safety code humans deliberately wrote as a problem.