#staticanalysis — Public Fediverse posts

Opengrep (open-source Semgrep fork) in v1.27.0 released

https://secburg.com/posts/opengrep-v1270-released/

#Opengrep #SAST #OpenSource #InfoSec #StaticAnalysis

Opengrep (open-source Semgrep fork) in v1.27.0 released

https://secburg.com/posts/opengrep-v1270-released/

#Opengrep #SAST #OpenSource #InfoSec #StaticAnalysis

I wrote a small blog post about the new release of patchlevel/event-sourcing-phpstan-extension, 1.3.0 adds three new rules.

They report aggregate properties that no event ever fills, state that nothing ever reads, and state that changes outside an apply method.

Also, every rule can be turned off individually.

Feel free to check it out!

https://patchlevel.dev/blog/what-is-new-in-the-event-sourcing-phpstan-extension-1-3-0

#TechBlog #PHP #DDD #EventSourcing #PHPStan #StaticAnalysis

(inspired today by coming across https://github.com/nikomatsakis/nll-rfc/blob/master/0000-nonlexical-lifetimes.md, from https://github.com/rust-lang/rfcs/pull/2094, and being Very Annoyed and/or Very Relieved at all the work it just caused-me-and-or-saved-me-depending-on-how-you-look-at-it, because I, too, was assuming lexical lifetimes, which was a stupid mistake to be making ...)

#staticanalysis #plt #optimization #programming

(inspired today by coming across https://github.com/nikomatsakis/nll-rfc/blob/master/0000-nonlexical-lifetimes.md, from https://github.com/rust-lang/rfcs/pull/2094, and being Very Annoyed and/or Very Relieved at all the work it just caused-me-and-or-saved-me-depending-on-how-you-look-at-it, because I, too, was assuming lexical lifetimes, which was a stupid mistake to be making ...)

#staticanalysis #plt #optimization #programming

A really weird side-effect of working on what is, effectively, an optimization engine, is that so, so many algorithmic/analytic/PLT things become .... easy? (or gradual?)

I get to ... say. no.

No matter what, I basically always have the option of *failing*: the engine can always fall back to "drive-to-⊤, decline-to-make-a-firm-statement - this falls towards Run."

No matter how much buried complexity, the tool, at its core, only has one actual job: decide whether to run a thing. And it's *always* safe to just Run The Thing.

#staticanalysis #plt #optimization #programming

A really weird side-effect of working on what is, effectively, an optimization engine, is that so, so many algorithmic/analytic/PLT things become .... easy? (or gradual?)

I get to ... say. no.

No matter what, I basically always have the option of *failing*: the engine can always fall back to "drive-to-⊤, decline-to-make-a-firm-statement - this falls towards Run."

No matter how much buried complexity, the tool, at its core, only has one actual job: decide whether to run a thing. And it's *always* safe to just Run The Thing.

#staticanalysis #plt #optimization #programming

🎉 Welcome to the mind-numbing black hole of Go Analysis Framework where the Go team insists you’ll become a static analysis ace 💫 by drowning in their manuals and case studies 📚. Instead of solving real-world problems, let's fill your brain with endless API docs, because who needs actual coding when you have "stories" and "release notes" to read! 🙄
https://pkg.go.dev/golang.org/x/tools/go/analysis #GoAnalysisFramework #StaticAnalysis #GoTeam #CodingFrustration #DeveloperHumor #HackerNews #ngated

🎉 Welcome to the mind-numbing black hole of Go Analysis Framework where the Go team insists you’ll become a static analysis ace 💫 by drowning in their manuals and case studies 📚. Instead of solving real-world problems, let's fill your brain with endless API docs, because who needs actual coding when you have "stories" and "release notes" to read! 🙄
https://pkg.go.dev/golang.org/x/tools/go/analysis #GoAnalysisFramework #StaticAnalysis #GoTeam #CodingFrustration #DeveloperHumor #HackerNews #ngated

Go Analysis Framework: modular static analysis by go team

https://pkg.go.dev/golang.org/x/tools/go/analysis

Comments: https://news.ycombinator.com/item?id=49057398

#HackerNews #GoAnalysis #Framework #modularStaticAnalysis #GoTeam #SoftwareDevelopment #StaticAnalysis

Go Analysis Framework: modular static analysis by go team

https://pkg.go.dev/golang.org/x/tools/go/analysis

Comments: https://news.ycombinator.com/item?id=49057398

#HackerNews #GoAnalysis #Framework #modularStaticAnalysis #GoTeam #SoftwareDevelopment #StaticAnalysis

Java‑код скомпилировался — это ещё не значит, что он работает

Есть целый класс Java‑багов, которые компилятор пропускает, а тесты на счастливом пути не ловят: код синтаксически корректен, но делает не то, что вы имели в виду. В статье разбираем пять таких самых частых ситуаций, которые встречаются у начинающих разработчиков.

https://habr.com/ru/companies/otus/articles/1047040/

#Java #staticanalysis #codereview #trywithresources #equalshashCode #SonarQube #NullPointerException #обучение

Opengrep (open-source Semgrep-fork) in v1.24.0 released

https://secburg.com/posts/opengrep-v1240-released/

#Opengrep #SAST #AppSec #StaticAnalysis #OpenSource #semgrep

Opengrep (open-source Semgrep-fork) in v1.24.0 released

https://secburg.com/posts/opengrep-v1240-released/

#Opengrep #SAST #AppSec #StaticAnalysis #OpenSource #semgrep

Rust's compile-time guarantees are deliberately incomplete - the compiler catches most issues, but not all. What's left behind is the question.

At Oxidize 2026, Rolland Dudemaine (TrustInSoft) shares findings from analysing production Rust code: what bugs survive, and when additional tooling is worth it.

🔗 https://oxidizeconf.com/sessions/whats_left_to_find_in_rust

#Oxidize2026 #RustLang #FormalVerification #StaticAnalysis #CodeQuality

Rust's compile-time guarantees are deliberately incomplete - the compiler catches most issues, but not all. What's left behind is the question.

At Oxidize 2026, Rolland Dudemaine (TrustInSoft) shares findings from analysing production Rust code: what bugs survive, and when additional tooling is worth it.

🔗 https://oxidizeconf.com/sessions/whats_left_to_find_in_rust

#Oxidize2026 #RustLang #FormalVerification #StaticAnalysis #CodeQuality

We released 1.2.0 of event-sourcing-phpstan-extension! See here for the changelog: https://github.com/patchlevel/event-sourcing-phpstan-extension/releases/tag/1.2.0
#PHP #DDD #EventSourcing #PHPStan #StaticAnalysis

Recently, I made a stupid mistake that made me think about the way C++ APIs handle dependencies and what we can do to prevent dangling references and lifetime issues. 🤔

It was a surprisingly fun topic to explore that led me to the discovery of a very cool static analysis tool. Can you guess which one? 😎

You can find out in the article I wrote about the topic here:
➤ https://medium.com/@nerudaj/type-safe-dependency-management-in-c-a293703f00ff

#cpp #StaticAnalysis #SoftwareEngineering

Recently, I made a stupid mistake that made me think about the way C++ APIs handle dependencies and what we can do to prevent dangling references and lifetime issues. 🤔

It was a surprisingly fun topic to explore that led me to the discovery of a very cool static analysis tool. Can you guess which one? 😎

You can find out in the article I wrote about the topic here:
➤ https://medium.com/@nerudaj/type-safe-dependency-management-in-c-a293703f00ff

#cpp #StaticAnalysis #SoftwareEngineering

REMnux v8 represents a structural modernization of a long-standing malware analysis distribution.

Technical highlights:
• Migration to Ubuntu 24.04 (modern kernel + LTS support)
• Cast-based installer replacing legacy CLI deployment
• AI-assisted workflows via MCP server
• Integration support for Ghidra with AI plugins

Tooling refresh includes:
YARA-X (Rust rewrite for performance improvements)
GoReSym (symbol recovery for Go binaries)
APKiD (Android packer detection)
Manalyze (PE/ELF/MachO static parsing)
This release signals an industry shift toward AI-augmented reverse engineering pipelines.
Is AI-assisted RE the new baseline for threat labs?

Source: https://cyberpress.org/remnux-v8-released/

Engage below.
Follow @technadu for deep technical cybersecurity updates.

#ThreatResearch #MalwareAnalysis #ReverseEngineering #YARAX #GoBinary #DFIR #Infosec #AIinSecurity #BlueTeam #StaticAnalysis #OpenSourceSecurity #SOC #ThreatHunting

Brakeman provides static analysis for Ruby on Rails by modeling data flow across application components and mapping results to known vulnerability patterns.

Its strength lies in early-stage visibility: identifying code-level issues, insecure configurations, and vulnerable dependencies before deployment. Support for baselining and result comparison helps teams manage findings over time.

From a security engineering perspective:
How do you measure the long-term value of static tools in mature Rails environments?

Source: https://www.helpnetsecurity.com/2026/01/26/brakeman-open-source-vulnerability-scanner-ruby-on-rails/

Join the discussion and follow @technadu for grounded AppSec coverage.

#ApplicationSecurity #StaticAnalysis #RailsSecurity #DevSecOps #Infosec #TechNadu

What the fuck is PHPStan

https://mago.carthage.software/

#PHP #StaticAnalysis #Mago #Rust #Performance

Mozilla's Firefox team explored extending Clang's Static Analyzer for whole-project taint tracking, aiming to devirtualize virtual calls across files. The prototype showed promise in richer control-flow modeling but stalled on ASTImporter's limitations in cross-file imports. This highlights the hurdles in scaling static analysis for complex codebases, urging better tools for open-source reliability. Thoughts on advancing CTU support? #OpenSource #StaticAnalysis #TechEthics

Python static analysis advances as mypy-pure and mypy-raise tackle purity and exception handling gaps. These tools enhance reliability by extending type checking into critical areas, supporting developers in building more robust and responsible code. Python's ecosystem evolves thoughtfully. #Python #StaticAnalysis #TechEthics

Working on a little static analysis of #Python code for common student snafus, but I haven't found the right tool yet. What library or technique beats regex (this seems easy) for finding calls to a certain function, or a function defined but never called?

I thought I might be able to figure this out by reading the CPython bytecode but not quite. All ideas welcome.

#computerscience #programming #development #staticanalysis #metrics #pedagogy

One Open-source Project Daily

CLI tool and library for generating a Software Bill of Materials from container images and filesystems

https://github.com/anchore/syft

#1ospd #opensource #containers #cyclonedx #docker #go #golang #hacktoberfest #oci #sbom #spdx #staticanalysis #tool

Now @emilysamp from #Shopify speaks about one of the most controversial topics in #RubyProgramming: #Types (and 🍦 @sorbet_ruby for that matter).

https://railsatscale.com/2025-04-23-rbs-support-for-sorbet/

Remember that you can easily generate type definitions with Tapioca:

https://github.com/Shopify/tapioca

#brightonruby2025 #brightonruby #types #staticanalysis #prism #sorbet #lsp #RubyLSP #gradualtyping #typesignatures #tapioca

One static analysis tool tells me to use `lstat` and `fstat` to avoid (or at least detect) malicious replacement of a file that I `open`. Then, after doing this, my other static analysis tool complains that I’ve introduced a TOCTOU (time-of-use, time-of-check) between `lstat` and `open`.

Sure, but I’m going to detect that. Real issue I have with all of this is that there’s still a window (which I estimate to be the about the same size in both versions of this program) between creating this pseudoterminal file and the next interaction I have with it (be that pulling file stats with `lstat` or `open`ing it).
#SemGrep #Coverity #StaticAnalysis #Programming #C

Just found this gem for my open source projects 🔥

🌈 **zizmor** — A static analysis tool for GitHub Actions.

🛡️ Finds common security issues in your GitHub Actions workflows & more!

🦀 Written in Rust!

⭐ GitHub: https://github.com/zizmorcore/zizmor

#rustlang #github #actions #workflows #cicd #automation #staticanalysis #terminal

Dylint - Run #Rust lints from dynamic libraries:

https://github.com/trailofbits/dylint

"Dylint is a Rust linting tool, similar to Clippy. But whereas #Clippy runs a predetermined, static set of lints, Dylint runs #lints from user-specified, dynamic libraries. Thus, Dylint allows developers to maintain their own personal lint collections."

Looks like a really cool project!

#Lint #RustLang #StaticAnalysis #Compiler

Clang-tidy helps modernize C/C++ code by detecting bugs, inefficiencies & outdated patterns. While setup can be tricky, it's a powerful ally for migrating large codebases to modern C++. #Cpp #ClangTidy #StaticAnalysis #CodeQuality
https://www.youtube.com/watch?v=EWq4mXjeDV8