---
title: "Static Code Analysis"
source: Microsoft Code-With Engineering Playbook
source_url: https://github.com/microsoft/code-with-engineering-playbook
licence: CC-BY-4.0
domain: engineering
subdomain: microsoft-code-with-playbook
date_added: 2026-04-25
---

# Static Code Analysis

Static code analysis is a method of detecting security issues by examining the source code of the application.

## Why Static Code Analysis

Compared to code reviews, Static code analysis tools are more fast, accurate and through.
As it operates on the source code itself, it is a very early indicator for issues, and coding errors found earlier are less costly to fix.

## Applying Static Code Analysis

Static Code Analysis should be integrated in your build process.
There are [many tools](https://owasp.org/www-community/Source_Code_Analysis_Tools) available for Static Code Analysis, choose the ones that meet your programming language and development techniques.

## Static Code Analysis Frameworks and Tools

[SonarCloud](https://sonarcloud.io) - static code analysis with cloud-based software as a service product.
[OWASP Source code Analysis](https://owasp.org/www-community/Source_Code_Analysis_Tools) - OWASP recommendations for source code analysis tools

## Conclusion

Static code analysis is essential to identify potential problems and security issues in the code. It allows you to detect bugs and security issues at an early stage.
