Anthropic’s new Claude Code Security Guidance plugin injects early warnings for command injection, XSS, deserialization and other common security pitfalls directly into the coding workflow, shifting safety checks from post‑review to the moment AI generates or edits code.
Anthropic’s security‑guidance plugin adds three progressive layers of automated security checks—instant string‑pattern matching, end‑of‑turn diff review, and deep commit‑time analysis—to Claude Code, letting the AI catch and fix common vulnerabilities as you code without blocking your workflow.
Security researchers performed a systematic reverse‑engineering study of Amazon Kindle's DRM, revealing the PBKDF2‑based key derivation, extracting the AES‑256 key through static .NET decompilation and dynamic Frida tracing, and demonstrating full decryption of protected e‑books.
New developers often drown in massive legacy codebases, struggling to map dependencies and understand architecture, but Understand‑Anything leverages Claude, Tree‑sitter, and multi‑agent pipelines to generate a searchable, visual knowledge graph, offering onboarding tours, semantic QA, incremental diff analysis, and cross‑language support, while the article also compares it against competing tools and provides installation and usage guidance.
This article explains how abstract syntax trees (AST) provide a structured representation of source code, how the Language Server Protocol (LSP) standardizes semantic queries, and why AI coding tools like Cursor, Claude Code, and OpenCode rely on LSP instead of simple text search, offering faster, more accurate, and lower‑cost code intelligence.
In a detailed blog post, curl creator Daniel Stenberg evaluated Anthropic’s AI security model Mythos by scanning 176,000 lines of curl’s C code, uncovering five reported issues that collapsed to a single low‑severity CVE after manual verification, and concluded that the model’s hype far exceeds its actual capability.
The 2025 PHP releases (8.4 and 8.5) introduce subtle engineering improvements—property hooks, asymmetric visibility, a pipe operator, clone‑and‑modify, higher framework baselines, stricter static analysis, and safer Composer practices—that together reshape daily coding, testing, and deployment without a radical language overhaul.
The article analyzes current AI code agents such as Claude Code and Cursor, highlights their three major limitations—guessing relationships, staying within the code domain, and lacking a temporal dimension—and proposes UModel’s deterministic AST extraction and cross‑domain linking to create a native code knowledge graph that lets agents move from merely finding code to truly understanding its structure.
CodeFlow is a browser‑only tool that, with just one HTML file, visualizes a project's dependency graph, calculates the explosion radius of code changes, identifies code owners, runs security scans, and exports detailed reports, all without installing software or uploading source code.
The article introduces YASA, a unified multi‑language static taint analysis framework built on a novel Unified Abstract Syntax Tree (UAST), explains its design, core components, open‑source releases, and benchmark results that demonstrate superior coverage, precision, and performance over existing single‑ and multi‑language tools.
PHPantom is a high‑performance, lightweight PHP language server written in Rust that starts in under a second, uses only 59 MB of memory, and offers deep type intelligence, project‑aware analysis, and extensive IDE features that surpass many existing tools.
This article introduces five essential Java static‑analysis tools—Alibaba Java Coding Guidelines, CheckStyle, PMD, FindBugs, and SonarLint—explaining their purpose, installation steps, usage methods, result interpretation, and configuration tips to help developers improve code quality and reduce review effort.
Claude’s newly launched AI‑powered code review uses multiple parallel agents to automatically scan pull requests, flagging issues with an internal consistency check that reduces false positives to under 1 %, while Anthropic reports detection rates of 84 % for large PRs and 31 % for small ones, though each review costs $15–25.
An in‑depth analysis of Codex Security’s scans shows that AI‑assisted code production doesn’t create new bug types but dramatically speeds up the spread of existing flaws, prompting a shift toward automated, engineering‑driven defenses for large‑scale code generation.
The article examines why shift‑left testing is now a practical necessity, compares five mainstream tools—SonarQube, ESLint + Jest + Cypress, Swagger/Pact, Cucumber, and Testim.io—across scenarios, integration depth, learning curve and ROI, and provides a decision framework backed by real‑world case studies.
This article presents a thorough mobile app penetration‑testing guide covering objectives, scope, testing methods, step‑by‑step workflow, recommended tools, reporting structure, and remediation advice to help developers and security professionals secure their applications.
The article explains that while AI‑assisted programming excels at small scripts, it faces three fundamental engineering challenges—code‑scale semantic gaps, long‑term maintainability, and high fault costs—in enterprise Java projects, and describes how Huawei Cloud CodeArts tackles these issues with a five‑layer “foundation” architecture.
Anthropic's new Claude Code Security tool uses an AI model that reads code like a human researcher, detecting complex logic‑flaw and permission‑control bugs missed by traditional pattern‑matching scanners, providing multi‑round verification, confidence scores, and AI‑generated patches while still requiring developer approval.
This article explains what static code analysis is, introduces PHPStan as a leading PHP static analysis engine, outlines its key benefits, provides step‑by‑step installation, configuration and usage instructions, and shows how to integrate and upgrade it within a backend development workflow.
This article explains why testing is essential, outlines its concrete benefits, compares static analysis tools like PMD and SonarQube, provides actionable test‑layout guidelines, suggests a phased adoption path, and defines key metrics for continuous test‑quality improvement.
Even as AI accelerates code generation, this article shows how Go’s native formatting, static analysis, and refactoring tools provide indispensable engineering constraints that keep large‑scale projects maintainable, predictable, and safe during extensive rewrites.
This article introduces the open‑source Spoon library for Java source‑code analysis and transformation, demonstrates how to integrate it with Spring Boot 3, and provides step‑by‑step examples—including visual AST inspection, empty‑catch detection, architecture rule validation, field usage checks, reflection replacement, and automatic code modifications such as adding fields, constructors, logging, and null‑checks.
This article explains why static code analysis is crucial for C/C++ development, outlines major standards such as MISRA, CWE and CERT, reviews both commercial and open‑source analysis tools, and provides guidance on selecting the right solution based on project needs, budget and integration requirements.
Spring Boot 4 adopts JSpecify’s null‑safety annotations, replacing JSR‑305, to make nullability explicit at compile time; using @NullMarked and @Nullable with tools like NullAway, developers can catch potential NPEs early, reduce defensive checks, improve API contracts, and handle collections and parameters more safely.
This guide introduces php‑syntax‑analyzer, a Rust‑written CLI that scans popular PHP packages from Packagist to detect potential conflicts when new keywords like let or using become reserved, explains its key features, installation steps, usage examples, important options, and current limitations.
This guide explains why refactoring embedded software is uniquely challenging, outlines preparation steps, presents basic to advanced refactoring techniques, shows hardware‑specific and real‑time optimizations, describes verification methods, and provides a concrete sensor‑data case study with measurable results.
The article analyzes the security challenges introduced by the open Model Context Protocol (MCP) ecosystem, outlines typical attack vectors such as command‑execution hijacking and indirect prompt injection, and presents MCPScan—an open‑source scanner that combines static taint analysis with LLM‑driven reasoning to detect exploitable tool chains before deployment.
Tree-sitter is a high‑performance incremental parsing library that supports over 50 languages; the article explains its core features, typical use cases such as editor syntax highlighting and static analysis, and walks through a concrete multi‑language SQL extraction implementation in Java, Python, and XML.
This guide explains how Psalm, a PHP static analysis tool, improves code quality by detecting type errors, logical bugs, and security issues, and covers its key features, installation steps, configuration options, IDE integration, automated fixes, and reasons to choose it over alternatives.
With software systems growing ever more complex, traditional text‑based code search falls short; this article explains how abstract syntax trees (AST) provide deeper structural understanding, improve query precision, enable advanced features like control‑flow analysis and knowledge‑graph construction, and outlines a full architecture for building AI‑enhanced code question‑answering systems.
This article compares SonarQube and Codacy, examining their histories, core features, security capabilities, deployment models, and ideal use‑cases, to help teams decide which static analysis solution aligns best with their workflow, technology stack, and compliance requirements.
This article examines why compilers can be unreliable, explains how optimization errors, undefined‑behavior assumptions, and hardware‑specific code generation can introduce subtle bugs, presents real‑world examples from GCC, MSVC and Clang, and offers practical strategies to detect and avoid such compiler faults.
The article explains GitLab SAST’s standardized JSON report format, walks through the meaning of the scan metadata and the vulnerabilities array, and shows that an empty vulnerabilities list together with a success status simply indicates a clean, successful static analysis run.
golangci-lint combines dozens of Go linters into a fast, configurable, and CI‑friendly tool that catches unused variables, long functions, style inconsistencies, and security issues, and this guide walks you through its features, installation, configuration, a real‑world example, and best practices.
This article explores a hybrid approach that combines traditional static application security testing (SAST) with large language models (LLM) to automatically detect business‑logic vulnerabilities, detailing the methodology, implementation stages, experimental results, and the challenges of integrating AI into code security analysis.
This article compares SonarQube, Infer, and Clang Static Analyzer for iOS development, detailing their language support, strengths, weaknesses, integration with CI/CD pipelines, and practical usage tips to help teams select the most suitable static analysis solution.
FixrLeak combines AST analysis with generative AI to detect and automatically repair Java resource leaks, dramatically reducing manual effort, improving code quality, and demonstrating the transformative potential of AI‑driven solutions in large‑scale software engineering.
This article explores modern PHP practices that move error handling from runtime try‑catch blocks to proactive strategies such as static analysis, contract programming, attribute‑based validation, and test‑driven development, showing how to build more reliable and maintainable backend applications.
This article explains why code quality degrades as systems grow, introduces five essential static‑analysis tools (Alibaba Java Coding Guidelines, CheckStyle, PMD, FindBugs, and SonarLint), and provides step‑by‑step installation and usage instructions with screenshots to help developers reduce bugs and improve maintainability.
This article explains why code quality matters in growing Java projects and introduces five essential static analysis tools—Alibaba Java Coding Guidelines, CheckStyle, PMD, FindBugs, and SonarLint—covering their purpose, installation steps, usage instructions, and key features to help developers reduce bugs and improve review efficiency.
The EXPRESS Workshop at ISSTA 2025, hosted by Ant Group, featured a keynote by Purdue’s Prof. Zhang on an LLM‑driven “Human‑like AI Auditor” called RepoAudit, which demonstrated high‑accuracy automated code review, uncovering dozens of real bugs and hundreds of zero‑day vulnerabilities across major open‑source projects.
This article walks you through installing and configuring the CheckStyle plugin in IntelliJ IDEA, importing coding standards such as Alibaba's, running checks on Java classes, and troubleshooting common errors like missing annotations, formatting issues, and import order problems, all illustrated with screenshots.
This article compares popular static‑code analysis tools for iOS—including SonarQube, Infer, and Clang Static Analyzer—detailing their language support, features, pros and cons, integration methods, and practical usage tips, helping developers select the most suitable solution for their projects.
This guide introduces essential Java code‑quality tools—including Alibaba Java Coding Guidelines, CheckStyle, PMD, FindBugs, and SonarLint—explaining their installation, usage, and key features so developers can automate static analysis, reduce bugs, and improve maintainability across projects.
This guide walks you through setting up a fully automated security code detection platform—covering environment preparation, installing JDK, MySQL, SVN, Maven, Tomcat, SonarQube, and Jenkins, configuring each component, integrating them via Jenkins pipelines, and running sample scans to generate actionable security reports.
This article explains what architecture testing is, why PHP projects need it, introduces tools like Deptrac, PHPArch and PHPMD, shows common testing scenarios, and provides best practices for integrating automated architecture tests into CI/CD pipelines to improve code quality and maintainability.
This article introduces PHPStan, a popular PHP static analysis tool, explains its benefits, provides step‑by‑step installation and configuration instructions, demonstrates how to run analyses, interpret error reports, troubleshoot common issues, and explore advanced techniques for improving backend code quality.
The award‑winning CDFuzz technique introduces a lightweight, targeted dictionary that eliminates extra instrumentation, achieves up to 16.1% higher coverage, discovers dozens of real bugs, and demonstrates that simple optimizations can outperform complex grey‑box fuzzing strategies across diverse file formats.
This article introduces the SootUp library, explains how to configure its Maven dependencies, describes the Jimple intermediate representation, and demonstrates how to use SootUp's API to analyze Java source code, bytecode, and method bodies through a series of code examples.
This article presents a comprehensive overview of the security challenges in HarmonyOS native ArkTS applications and describes the design and implementation of a specialized static analysis framework—including source extraction, data‑flow and inter‑function analysis, knowledge‑graph construction, and risk inference engine—while also outlining integration into development pipelines and future research directions.
The author recounts attending PyCon LT 2025 Data Day, summarizing talks on building a simple static code analyzer with AST, challenges of data warehouses versus data lakes, cloud cost‑scraping pipelines, A/B testing libraries, privacy‑enhancing data processing, and tools like Panel and Dagster, while noting the inspiring presence of female speakers.
This article introduces several Java code quality tools—including Alibaba Java Coding Guidelines, CheckStyle, PMD, FindBugs, and SonarLint—detailing their installation, usage, and key features to help developers improve code standards, detect bugs, and streamline code review processes.
This article details Alibaba's security team's comprehensive approach to detecting ArkTS code vulnerabilities in HarmonyOS apps, covering architectural design, static analysis techniques, knowledge‑graph modeling, CI/CD integration, and future AI‑driven enhancements.
The article reviews open‑source static analysis options for iOS, then compares SonarQube, Infer, and Clang Static Analyzer, outlining each tool’s language support, advantages, drawbacks, CI/CD integration, and practical usage to help teams choose the best solution based on project size, language mix, and reporting needs.
Learn how to enhance Java code quality and reduce review effort by using a suite of static analysis tools—including Alibaba Java Coding Guidelines, CheckStyle, PMD, FindBugs, and SonarLint—covering installation, configuration, usage, and interpretation of results to catch bugs and enforce standards.
This article presents a comprehensive overview of using static analysis and change‑impact techniques—including program slicing, variable lineage, and automated field mapping—to reduce risk‑related incidents in large‑scale financial systems by more than 50%, outlining the background, solution architecture, implementation steps, and optimization challenges.
This article examines how Kuaishou’s internal Mulan universal code analysis service tackled pipeline quality challenges by introducing on‑demand triggering, incremental checking, and unified rule infrastructure, resulting in dramatically faster static checks, lower rule‑development costs, comprehensive monitoring, and a rapid increase in rule coverage.
This article explains how Kuaishou’s Vision platform tackles animation asset delivery challenges by introducing systematic admission and egress detection, static and dynamic analysis services, image efficiency checks, performance testing, and open SDK/API, ultimately improving stability, reducing crashes, and streamlining the workflow.
Go 1.24 brings significant toolchain updates—including a new go.mod tool directive for managing executable dependencies and enhanced vet analyzers—that streamline dependency tracking, speed up builds, and help developers catch bugs earlier, ultimately improving productivity and code quality.
This article explains cyclomatic complexity concepts, industry standards, calculation methods, and how a custom ESLint rule can be used to assess both single‑function and nested‑function complexity in front‑end projects, including scoring thresholds and practical implementation details.
This article explores the concept of code maintainability, explains why it matters, defines key measurement metrics such as naming conventions, comment density, code volume, logical lines, cyclomatic complexity, similarity and redundancy, and provides practical improvement techniques and tool recommendations for modern front‑end projects.
The article introduces a data‑driven, Datalog‑based cross‑language program analysis technique presented in an ICSE 2025 paper, describes the open‑source CodeFuse‑Query platform, its technical innovations, and multiple production scenarios such as code evaluation, precise testing, dead‑code detection, and large‑scale code data cleaning.
This article recounts a date‑misalignment bug caused by an unintended Day.js locale change in a mini‑program, explains why the global locale must remain unique, and details a comprehensive static‑analysis solution using ESLint, custom Webpack loaders, and Babel plugins to intercept and block Day.js locale modifications at compile time.
This article details Zhuanzhuan's practical implementation of static code scanning within its self‑built DevOps platform, covering its significance, architecture, incremental analysis methods, permission management, rule selection, promotion process, and challenges encountered, illustrating how it became a low‑cost, repeatable security safeguard in their CI/CD workflow.
This article details how a microservice‑based backend team designed and implemented a code‑analysis platform that creates a knowledge base, enables precise test selection and application slimming, and ultimately accelerates demand iteration while reducing dead code and unnecessary test runs.
ShellCheck is a popular open‑source static analysis tool that scans Bash, sh, ksh, and dash scripts, highlighting syntax mistakes, unsafe commands, and logic flaws, while offering detailed explanations and fixes, and can be run via CLI, editors, CI pipelines, or Docker.
PXP is a collection of tools and libraries that combine Rust and PHP to create a fast, reliable superset of PHP with modern language features, a language server, static analyzer, formatter and linter, aiming to improve the overall PHP developer experience.
This article explains ESLint's highly configurable static analysis architecture, clarifies the roles of parsers, processors, configs and plugins, explores the intricacies of its configuration system, and provides practical debugging methods—including performance profiling and a real‑world import/no-cycle case study.
This article explains Go’s dead code elimination (DCE) optimization, demonstrates it with sample code, shows how to inspect compiled binaries using go tool nm, and discusses factors that affect DCE such as code complexity, compiler flags, and reflection, helping developers reduce binary size.
This article explains the importance of code review, outlines its core goals and basic principles, provides step‑by‑step practical guidance with a detailed checklist, shares real‑world case studies and code examples, and discusses metrics and future AI‑assisted improvements to help teams improve software quality.
This article explains how to develop custom ESLint plugins—covering background concepts, Yeoman generator setup, rule implementation for typeof and instanceof checks, unit testing, local linking, and providing recommended configurations—to ensure consistent code style and best‑practice enforcement across a development team.
This article explains the importance of code review, outlines its core objectives and basic principles, describes practical steps and a detailed checklist, shares several real‑world case studies with before‑and‑after code snippets, and discusses the benefits, metrics, and future AI‑assisted enhancements.
This comprehensive guide explains why code review is essential, outlines its core goals and principles, provides step‑by‑step practices and a detailed checklist, shares five real‑world case studies with before‑and‑after code, and looks ahead to AI‑assisted review tools.
This guide presents ten practical strategies—including IDE selection, static analysis tools, unit testing, code reviews, and learning from others' post‑mortems—to help developers dramatically reduce bugs, improve code quality, and increase overall productivity.
This article provides a step‑by‑step tutorial for installing and configuring the CheckStyle plugin in IntelliJ IDEA, explains how to address common CheckStyle warnings such as missing annotations, spacing, naming, formatting, logical errors and import‑order issues, includes screenshots, and also contains promotional material for ChatGPT services and a community group.
This guide introduces ShellCheck, a static analysis tool for Linux shell scripts, outlines its key features, shows how to install it on various distributions or use it online, demonstrates command‑line usage with a practical example, and explains integration with editors like VSCode.
This guide walks you through installing and configuring the CheckStyle plugin in IntelliJ IDEA, explains how to import custom rule sets, and details common style violations such as missing annotations, spacing, naming, formatting, logical errors, and import order, offering practical fixes to keep Java code clean and consistent.
This article introduces three static analysis tools—Source Insight, Understand, and Source Trail—detailing their visualization, code checking, exploration, and comparison features, while highlighting platform support, usability, and maintenance status to help developers choose the best aid for reading code efficiently.
This article introduces three static‑analysis‑based code‑reading tools—Source Insight, Understand, and Sourcetrail—detailing their visualization, inspection, exploration, and comparison features, platform support, and maintenance status to help developers choose the most suitable aid for efficient source‑code comprehension.
This article introduces Google Wire, a static‑analysis‑based dependency injection tool for Go, covering its key features, installation steps, core usage patterns—including defining dependencies, creating providers, generating code, and best practices such as modular management, interface abstraction, and testing with mock implementations.
APKDeepLens is a Python‑based tool that automatically scans Android APK files for security flaws, covering the OWASP Top 10 mobile risks and providing detailed, actionable reports for developers, pentesters, and security researchers.
This article presents a design and implementation of both static AST‑based scanning and runtime JaCoCo coverage analysis to automatically detect unused (zombie) Java methods, describing the workflow, required dependencies, code snippets, and how to visualize active versus dead code in the IDE.
This article explains static code analysis, introduces PHPStan as a leading PHP static analysis engine, outlines its advantages, provides step‑by‑step installation and configuration instructions, describes level upgrades, and shows how to integrate it into development workflows to improve code quality and security.
To cut bugs and boost productivity, developers should use a robust IDE, integrate static analysis tools like FindBugs and CheckStyle, run SonarQube and Fortify for quality and security checks, write unit and functional tests, automate regression suites, and regularly conduct peer code reviews.
This article presents ten practical techniques—including choosing the right IDE, integrating static analysis tools like FindBugs and CheckStyle, using SonarQube and Fortify, writing unit and automated tests, performing incremental code reviews, and learning from others' pitfalls—to help developers dramatically reduce bugs and improve code quality.
This article explains how to use static analysis tools like IDEA and PMD together with dynamic coverage tools such as JaCoCo to identify, clean up, and refactor unused, duplicated, or dead Java code in large backend projects, improving maintainability and stability.
This guide explains how to install SonarLint in IDEs like PHPStorm, run on‑the‑fly scans, interpret common PHP code‑smell warnings, and apply concrete fixes for issues such as missing braces, improper loop conditions, unreachable catch blocks, and absent default cases in switch statements.
This guide explains how to import, configure, and apply the CheckStyle plugin in IntelliJ IDEA, covering common annotation, formatting, naming, logical, and import‑order issues, and provides step‑by‑step screenshots to help Java developers enforce coding standards efficiently.
This article explains the fundamentals of code visualization, why it is needed, presents several real‑world scenarios, and details both static (source‑based and bytecode‑based) and dynamic analysis techniques for generating call graphs, along with their advantages, disadvantages, tools, and case studies.
This article presents a curated list of essential tools for PHP developers—including IDEs, AI‑powered assistants, database managers, static analysis utilities, code formatters, container platforms, debuggers, testing frameworks, and deployment automation—to streamline workflows, boost productivity, and improve code quality.
This article describes how to construct a code‑analysis platform for Java micro‑services that builds a knowledge base through static, semi‑dynamic and dynamic analysis, enabling precise test‑case selection and safe removal of dead code to improve iteration efficiency and system maintainability.
This guide explains what SonarQube is, its advantages, architecture, and provides step‑by‑step Docker installation, project setup, scanner configuration, and real‑world examples of detecting unreachable code and unused parameters.
This article explains what static code scanning is, why PHP projects especially need it due to weak typing, runtime compilation and dependency complexity, compares popular tools like PHPStan, PHPSA and Phan, and shows how to integrate scanning into a release workflow.
The paper presents an AI‑driven static analysis framework that builds code knowledge graphs to extract relevant slices and leverages large language models for multilingual defect prediction, achieving up to 80% F1, detecting 662 defects across 1,100 C++ modules with a 26.9% recall gain over traditional rule‑based scanners.
This guide explains static code scanning concepts, compares popular tools, introduces Tencent’s open‑source TscanCode, details its supported languages and detection capabilities, and provides step‑by‑step instructions for running the tool on Linux and Windows with example code and results.
This article explains how to use Python scripts to automate the analysis and refactoring of iOS configuration data items in Baidu App, detailing the extraction of public properties, usage detection across modules, CSV reporting, and the overall refactoring workflow to improve maintainability and reduce risk.
Learn how to install Go, verify its version, configure environment variables, initialize modules, manage dependencies, build binaries, format code, tidy unused packages, run and test your applications, and use vet for static analysis—all with concise command-line examples for efficient Go development.
This article explains how to integrate the C++ Core Guidelines checker via Clang‑Tidy into Android C++ projects, covering setup in ndk‑build and Android Studio, using quick‑fixes to automatically refactor code, generating a JSON compilation database, and highlighting the guidelines' impact on modern C++ talent development.
The article examines how rising code volume and AI‑generated snippets challenge traditional code review, proposes an LLM‑assisted workflow using AutoDev and DevOpsGenius, details prompt design, commit filtering, and implementation steps, and discusses the benefits and limitations for different team roles.
This article explores the fundamentals of code understanding, including static, dynamic, and non‑code analysis, presents a three‑layer architecture for scalable code comprehension, and demonstrates practical AI‑enhanced applications such as intelligent unit testing, dead‑code detection, and AI‑based static analysis within CI/CD pipelines.
