#static-analysis

SecScan is a fast, configurable secret scanning tool written in Go that detects API keys, tokens, credentials, and high-entropy secrets across source code and full Git history. Built for developers and CI pipelines, with strong defaults and low false positives.

An Elixir tool for checking safety of database migrations.

Various code metrics for Python code

Static analysis for GitHub Actions

rpcguard checks if connect-RPC endpoint method is implemented properly

El repositorio no publica descripción.

Deterministic cross-repo contract analysis you can gate CI on — joins frontend calls to backend routes across repo boundaries and flags drift (typo'd path, version skew, dead endpoint). Also a multi-language SAST/architecture engine (TS/JS, Prisma, Java), extensible via adapters. Rust core, npm CLI/SDK.

The quality ratchet for TS/JS: 9 zero-config gates against a versioned baseline — quality can only improve, never regress.

PHP stubs for Moodle LMS - classes, functions, constants, and global variables for IDE and static analysis support

Security linter for a-h/templ: detects XSS-prone htmx / Alpine.js usage by parsing .templ files directly with parser/v2