Also known as: SAST · linting · static application security testing
Static analysis examines source code without executing it, detecting bugs, security vulnerabilities, and style violations by reasoning about possible program behaviours.
Because it analyses all code paths rather than only those exercised by tests, static analysis catches issues testing misses. The unavoidable trade-off is between false positives and false negatives — a tool tuned to catch everything produces noise that teams learn to ignore.
The security-focused variant, SAST, targets patterns such as injection, unsafe deserialisation, and hardcoded credentials. Its value in practice depends far more on tuning and integration into review workflow than on raw rule count.
Type System
A type system is a set of rules that assigns types to program constructs and verifies their consistent use, catching a class of errors before the program runs in statically-typed languages, or during execution in dynamically-typed ones.
Fuzzing
Fuzzing is an automated testing technique that feeds a program large volumes of malformed, unexpected, or random input to discover crashes, hangs, and memory-safety violations.
Code Review
Code review is the practice of having changes examined by other engineers before they are merged, catching defects, spreading knowledge, and maintaining consistency across a codebase.
Technical Debt
Technical debt is the accumulated future cost of choosing an expedient implementation over a better one, analogous to financial debt in that it carries ongoing interest in the form of slower development and higher defect rates.
CI/CD
CI/CD (continuous integration and continuous delivery) is the practice of automatically building, testing, and deploying code changes, so that every commit is verified and releases become routine rather than exceptional events.