Static analysis

Evidence (9)

• 5Martin Fowler·9/2/2026framework_update
  Martin Fowler Says Code Review Is Solving the Wrong Problems

  Martin Fowler argues that AI-driven code generation is making traditional code review too overloaded to serve as the main quality gate. He suggests moving feedback earlier through pairing, design sessions, trunk-based development, automated testing, static analysis, fitness functions, and security scanning, while reserving review for issues that cannot be checked automatically.

• 4InfoQ·8/27/2026research
  Making Testing More Sustainable

  The article outlines ways to reduce the cost of software testing by skipping unnecessary tests, failing fast, and running only tests impacted by code changes. It also suggests tracking energy use per test and using static code analysis to find inefficiencies and improve test strategy.

• 4The New Stack·8/25/2026framework_update
  Verification First for AI Coding Agents

  The article argues that the real question for AI coding agents is not whether they run in a CLI or an IDE, but how teams verify the changes they produce. It recommends treating agent output as a proposed change and using layered checks such as linting, static analysis, type checks, and other reviews to ensure correctness, security, and maintainability.

• 4Hacker News·8/19/2026open_source
  Tool auto-patches Sierra games to avoid unwinnable states

  A Hacker News post introduces the Lucasartsifier, a static analysis tool that decompiles Sierra adventure game resource files and detects “walking-dead” states where players can become stuck later with no viable path forward. It then generates patch files to block those states, and currently supports several Sierra SCI-era games including Leisure Suit Larry 2, King's Quest 4, King's Quest 6, and Laura Bow 2.

• 5The New Stack·8/9/2026research
  Coding agents can be evaluated by their work

  The article argues that coding agents are difficult, but not impossible, to evaluate, and that they should be assessed as whole systems rather than as standalone models. It proposes judging them by executable outcomes, change quality, trajectory, human intervention, cost, and production impact instead of relying only on pass/fail test scores.

• 5Martin Fowler·5/27/2026security
  Fowler on agentic coding, code cleanup, and UK public repo closures

  Martin Fowler summarizes several recent software-development posts and talks, including a discussion with Kent Beck about LLM-augmented programming and the role of junior developers. He also highlights an account of restructuring a legacy Laravel and React codebase with tests, static analysis, and a more agent-driven workflow, plus criticism of the UK NHS closing open-source repositories due to LLM-related security concerns.

• 6Martin Fowler·4/29/2026framework_update
  AI Coding Shifts Toward Harness Engineering and Verification

  Martin Fowler highlights updated guidance from Chris Parsons and related work on harness engineering, emphasizing small changes, strong guardrails, and automated verification before code is shipped. The discussion also points to tools and techniques such as Claude Code, Codex CLI, static analysis, and tests as central to agentic software development.

• 5OpenAI Blog·3/16/2026security
  Why Codex Security Skips Traditional SAST Reports

  OpenAI explains that Codex Security does not depend on conventional static application security testing reports. Instead, it uses AI-driven constraint reasoning and validation to identify real vulnerabilities while reducing false positives.

• 8Anthropic News·2/20/2026security
  Anthropic launches Claude Code Security preview for defenders

  Anthropic introduced Claude Code Security, a limited research preview built into Claude Code on the web that scans codebases for security vulnerabilities and suggests patches for human review. The company says it is designed to help defenders find subtle issues that rule-based tools often miss, with findings verified, scored by severity, and requiring human approval before fixes are applied.