Security-focused static analysis

Static analysis reads code without running the application. A simple rule may look for one risky pattern. A deeper query can follow data through several functions or understand how a framework handles it. The purpose is to find a specific security problem early enough to fix it in code review.

A false positive happens when a rule flags code that is safe in its real context. The rule may be too broad, miss a safe wrapper, or misunderstand how the framework handles the data. I reduce that noise by adding those safe cases to the rule and its tests.

A good rule starts with a real risky behavior. It catches vulnerable examples, ignores realistic safe ones, and explains why the match matters. The message should give the developer enough context to fix the code without having to read the rule first.

Write a custom rule when the same bug keeps appearing and the standard rules miss it or flag it badly. Start with real vulnerable and safe examples. Then choose Semgrep or CodeQL based on how much context the check needs.