Static Analysis

A Go service can pass every test, clear go vet without a word, and still be quietly broken. The kind of bug I mean does not throw an exception or fail an assertion. It leaks. A file handle that never gets closed, a goroutine that nobody waits for, a lock that an early return skips over. Each one is invisible on a laptop with a single request in flight, and each one turns into a 3 a.m. incident once real traffic arrives: file descriptors exhausted, memory climbing with abandoned goroutines, a handler wedged on a lock that was never released. ...

Coding agents are good at writing code that looks right. The failure mode everyone who uses them has hit is code that calls something that doesn’t exist: a helper the model assumed you had, a method the library never shipped, a package name that sounds plausible. Python doesn’t complain until the line runs. A reviewer skimming a 400-line agent PR may not notice either, because the code reads fine. The Rabbit Hole Generator picked Skylos this week. Its pitch for that problem is to treat review as a proof: before a human looks, statically check that every package, helper, and API the change references actually exists, and say incomplete instead of guessing when it can’t tell. Its README tagline is “Code checks that show their work.” That’s a claim a security reader can test directly, so I did. I planted eight different AI-style mistakes and ran them through Skylos, through two ordinary Python tools for comparison, and through the pull request gate Skylos generates for GitHub Actions. Then I tried to get a bad change past that gate. ...

Research Disclaimer This tutorial is based on: Semgrep v1.55+ (SAST scanning) Bandit v1.7+ (Python security linter) CodeQL v2.15+ (GitHub Advanced Security) SonarQube v10.3+ (code quality & security) Academic research on AI code generation security (NYU 2023 study, Stanford 2024 study) OWASP Top 10 2021 vulnerability classifications All code examples demonstrate production-grade security scanning integrated into CI/CD pipelines. Tested with GitHub Actions, GitLab CI, and Jenkins. Security recommendations follow OWASP and NIST guidelines. ...