Static code analysis is the analysis of computer software performed without actually executing the code. Static code analysis tools scan all code in a project and seek out vulnerabilities, validates code against industry best practices, and some software tools validate against company-specific project specifications. Static code analysis tools are used by software development and quality assurance teams to ensure the quality and security of code, and that project requirements are met. Static code analysis is a type of source code management and can integrate with version control systems and through build automation tasks using continuous integration software.
To qualify as a static code analysis tool, a product must:
Scan code without executing that code
List security vulnerabilities after scanning
Validate code against industry best practices
Provide recommendations on where and how to fix issues