Awesome Reviewers

Verification · Static analysis

Data and control flow analysis

Builds a code property graph or interprocedural model to answer reachability questions: can this null reach that dereference, which callers reach this function.

Sub-techniques

  • Interprocedural null and resource analysis V1014.001

    Report null dereferences and leaks along concrete paths.

  • Code property graph queries V1014.002

    Query syntax, control flow and data flow together to find custom bug patterns.

  • Call graph impact V1014.003

    List every caller and downstream consumer of a changed symbol.

How to build it

  1. Run the analyzer on the default branch to establish a baseline.
  2. Run it on the change and report only new paths.
  3. Save the queries that found real bugs as regression rules.

Signals in a repository

  • infer or spotbugs tasks in the build, or Joern scripts in the repository.
  • SCIP or LSIF index uploads in CI for code navigation.