Which static code analyses are performed?
amaise uses static application security testing (SAST) for all programming languages, automatically run at every build:
Language | Tools | Focus |
Java | SpotBugs, PMD, Checkstyle | Security vulnerabilities, bugs, coding standards |
Python | ruff (including bandit security rules), mypy | Security patterns, strict type checking |
TypeScript | ESLint | Code quality and security patterns |
Terraform | tfsec, tflint | Infrastructure security misconfigurations, best practices |
All analyses are integrated into the CI/CD pipeline. Findings block the build — if an issue is detected, the build is immediately aborted. Code can only be merged if all analyses pass.