Source code analysis is the process of inspecting source code to understand its structure, quality, security, and behavior—without running it (in the case of static analysis) o

---

🔍 Types of Source Code Analysis

1. Static Code Analysis

• When: Performed without executing the program

• Tools: Analyze syntax, structure, data flow, and dependencies

• Detects:

  • Syntax errors

  • Security flaws (e.g., buffer overflows, SQL injection)

  • Code smells (e.g., large methods, duplicated code)

  • Non-compliance with coding standards

• Popular Tools:

  • SonarQube (multi-language)

  • ESLint (JavaScript/TypeScript)

  • Pylint (Python)

  • Cppcheck (C/C++)

  • PMD (Java)

2. Dynamic Code Analysis

• When: Performed during program execution

• Focus: Runtime behavior like memory usage, CPU cycles, or input/output handling

• Detects:

  • Memory leaks

  • Performance bottlenecks

  • Race conditions

• Popular Tools:

  • Valgrind (C/C++)

  • JProfiler (Java)

  • DotTrace (C#)

---

🔒 Security-Oriented Code Analysis

Often used in DevSecOps pipelines to find:

• Hardcoded secrets

• Insecure APIs

• Path traversal issues

• Privilege escalation vulnerabilities

Tools like Bandit (Python), Brakeman (Ruby on Rails), or Checkmarx are popular here.

---

✅ Common Goals

• Improve code quality

• Catch bugs early

• Ensure security

• Support refactoring

• Aid code reviews

---