| dc.contributor.author | Мілінчук, М. К. | uk |
| dc.contributor.author | Чопляк, В. В. | uk |
| dc.contributor.author | Milinchuk, M. K. | en |
| dc.date.accessioned | 2026-09-03T10:36:08Z | |
| dc.date.available | 2026-09-03T10:36:08Z | |
| dc.date.issued | 2026 | |
| dc.identifier.citation | Мілінчук М. К., Чопляк В. В. Static code analysis as a tool for improving software quality in modern applications // Матеріали Міжнародної науково-практичної інтернет-конференції «Молодь в науці: дослідження, проблеми, перспективи (МН-2026)», м. Вінниця, 22-26 червня 2026 р. Електрон. текст. дані. 2026. URI: https://conferences.vntu.edu.ua/index.php/mn/mn2026/paper/view/29489. | uk |
| dc.identifier.uri | https://ir.lib.vntu.edu.ua/handle/123456789/53177 | |
| dc.description.abstract | This paper examines static code analysis as an effective method for ensuring software quality. The principles of static analysis tools and their integration into development processes and CI/CD pipelines are analyzed. Special attention is paid to the early detection of security vulnerabilities, technical debt, and coding standard violations. The advantages of applying static code analysis for improving the reliability and maintainability of modern software are determined. | en |
| dc.description.abstract | У даній роботі розглянуто статичний аналіз коду як ефективний метод забезпечення якості програмного забезпечення. Проаналізовано принципи роботи інструментів статичного аналізу, їх інтеграцію у процеси розробки та CI/CD-конвеєри. Особливу увагу приділено виявленню вразливостей безпеки, технічного боргу та порушень стандартів кодування на ранніх етапах розробки. Визначено переваги застосування статичного аналізу коду для підвищення надійності та підтримуваності сучасного програмного забезпечення. | uk |
| dc.language.iso | en_US | en_US |
| dc.publisher | ВНТУ | uk |
| dc.relation.ispartof | Матеріали Міжнародної науково-практичної інтернет-конференції «Молодь в науці: дослідження, проблеми, перспективи (МН-2026)», м. Вінниця, 22-26 червня 2026 р. | uk |
| dc.relation.uri | https://conferences.vntu.edu.ua/index.php/mn/mn2026/paper/view/29489 | |
| dc.subject | статичний аналіз коду | uk |
| dc.subject | якість програмного забезпечення | uk |
| dc.subject | SAST | en |
| dc.subject | технічний борг | uk |
| dc.subject | CI/CD | en |
| dc.subject | безпека коду | uk |
| dc.title | Static code analysis as a tool for improving software quality in modern applications | en |
| dc.type | Thesis | |
| dc.identifier.udc | 004.41:004.052.2 | |
| dc.relation.references | , buffer overflows, SQL injection vulnerabilities, and violations of coding standards such as MISRA or CERT. Among the most widely used tools are SonarQube, ESLint, Checkstyle, PMD, and Coverity. Each tool targets specific programming languages and provides configurable rule sets tailored to different quality objectives. SonarQube, for instance, supports over twenty-five programming languages and delivers dashboards with metrics on code coverage, code smells, duplications, and security hotspots [4]. One of the most significant advantages of static analysis is its seamless integration into continuous integration pipelines. When configured as a mandatory step in CI/CD workflows, static analysis tools automatically block code with critical violations from being merged into the main branch, enforcing quality gates at scale. This practice shifts quality assurance to the left in the development lifecycle, substantially reducing the cost of identifying and fixing defects compared to later-stage testing. Static Application Security Testing (SAST) represents a specialized form of static analysis focused on identifying security vulnerabilities such as cross-site scripting (XSS), insecure cryptographic usage, and hardcoded credentials [5]. SAST tools are increasingly incorporated into DevSecOps workflows, ensuring that security considerations are addressed from the earliest stages of development rather than as an afterthought. Despite their advantages, static analysis tools also present certain limitations. They may generate false positives, flagging code that is technically correct, which can erode developer trust and encourage rule suppression over time. Additionally, static analysis cannot detect runtime-dependent bugs or concurrency issues that only manifest during actual program execution. Conclusion In conclusion, static code analysis represents an indispensable tool in modern software quality assurance. By detecting defects, vulnerabilities, and code quality issues at the source level, it enables development teams to build more reliable and secure software while reducing downstream maintenance costs. The integration of static analysis into CI/CD pipelines and DevSecOps workflows is becoming a standard practice in professional software development. Future advances in AI-assisted code analysis are expected to further reduce false positive rates and significantly improve the accuracy of defect detection in complex software systems. REFERENCES | en |
| dc.relation.references | OWASP Static Code Analysis. URL: https://owasp.org/www-community/controls/Static_Code_Analysis. | en |
| dc.relation.references | Introduction to Static Analysis / Synopsys. URL: https://www.synopsys.com/glossary/what-is-sast.html. | en |
| dc.relation.references | Abstract Syntax Trees and Static Analysis. URL: https://www.geeksforgeeks.org/abstract-syntax-tree-ast-in-java/. | en |
| dc.relation.references | SonarQube Documentation. URL: https://docs.sonarqube.org/latest/. | en |
| dc.relation.references | SAST – Static Application Security Testing / Gartner. URL: https://www.gartner.com/en/informationtechnology/glossary/static-application-security-testing-sast. | en |
