Skip to content
All tags

#static-analysis

2 posts
tech deep-dive Technology Choices in the AI Era

CodeQL: Extracting a Codebase into a Database and Querying Data Flow

CodeQL builds a code database with language extractors, then queries syntax, types, calls, control flow, and data flow; its depth depends on models and carries extraction and query-maintenance costs.

#codeql#sast#github#static-analysis#security
tech deep-dive Technology Choices in the AI Era

Semgrep: Encoding Security Policy as Readable, Tested Static Analysis

Semgrep lets teams express SAST policy with source-like patterns and taint rules; rule quality depends on positive and negative tests, framework modeling, and exception lifecycle.

#semgrep#sast#appsec#static-analysis#security