Which static code analyses are performed?
amaise uses static application security testing (SAST) for all programming languages, automatically run at every build:
Language | Tools | Focus |
Java | SpotBugs (with security detectors), Checkstyle; Error Prone on the main backend; PMD on the Agent SDK | Security vulnerabilities, bugs, coding standards |
All languages | Semgrep (security SAST on every pull request) and SonarQube (maintainability of new code) | Injection, secrets handling, CI/CD hygiene; code smells, duplication, coverage of new code |
Python | ruff (including bandit security rules), mypy | Security patterns, strict type checking |
TypeScript | ESLint | Code quality and security patterns |
Terraform | Trivy (misconfiguration scanning) and tflint | Infrastructure security misconfigurations, best practices |
All analyses are integrated into the CI/CD pipeline. Findings block the build — if an issue is detected, the build is immediately aborted. Code can only be merged if all analyses pass.