The DOI matches its Crossref record; 23 of the 23 references it cites were found in a registry or an index.
Lessons from building static analysis tools at Google
Open accessAbstract
For a static analysis project to succeed, developers must feel they benefit from and enjoy using it.
Overview
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Verification
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
The cited source says what the claim attributes to it.
In the citing paper
“industry reports show that it is difficult to get developers to adopt static analysis in their workflows [5, 11, 30, 34].”
From Position: Vibe Coding Needs Vibe Reasoning: Improving Vibe Coding with Formal Verification (2025) · cites this paper as [30]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Citations
Cites
Hovemeyer, D., & Pugh, W. (2004) · Companion to the ACM SIGPLAN Conference on Object-Oriented Programming, Systems, Languages, and Applications (OOPSLA Companion) · doi:10.1145/1028664.1028717 · Cited by 770
A few billion lines of code later
Bessey, A., Block, K., Chelf, B., Chou, A., Fulton, B., Hallem, S., Henri-Gros, C., Kamsky, A., McPeak, S., & Engler, D. (2010) · Communications of the ACM · doi:10.1145/1646353.1646374 · Cited by 634
Using Static Analysis to Find Bugs
Ayewah, N., Pugh, W., Hovemeyer, D., Morgenthaler, J. D., & Penix, J. (2008) · IEEE Software · doi:10.1109/ms.2008.130 · Cited by 536
Cousot, P., Cousot, R., Feret, J., Mauborgne, L., Miné, A., Monniaux, D., & Rival, X. (2005) · Lecture Notes in Computer Science · doi:10.1007/978-3-540-31987-0_3 · Cited by 426
Hovemeyer, D., & Pugh, W. (2004) · ACM SIGPLAN Notices · doi:10.1145/1052883.1052895 · Cited by 397
Thorough static analysis of device drivers
Ball, T., Bounimova, E., Cook, B., Levin, V., Lichtenberg, J., McGarvey, C., Ondrusek, B., Rajamani, S. K., & Ustuner, A. (2006) · European Conference on Computer Systems · doi:10.1145/1217935.1217943 · Cited by 373
Chambers, C., Raniwala, A., Perry, F., Adams, S., Henry, R. R., Bradshaw, R., & Weizenbaum, N. (2010) · ACM SIGPLAN Conference on Programming Language Design and Implementation (PLDI) · doi:10.1145/1806596.1806638 · Cited by 330
Moving Fast with Software Verification
Calcagno, C., Distefano, D., Dubreil, J., Gabi, D., Hooimeijer, P., Luca, M., O’Hearn, P. W., Papakonstantinou, I., Purbrick, J., & Rodriguez, D. (2015) · Lecture notes in computer science · doi:10.1007/978-3-319-17524-9_1 · Cited by 272
Why don’t software developers use static analysis tools to find bugs
Johnson, B., Song, Y., Murphy-Hill, E. R., & Bowdidge, R. W. (2013) · Cited by 268
Why Google stores billions of lines of code in a single repository
Potvin, R., & Levenberg, J. (2016) · Communications of the ACM · doi:10.1145/2854146 · Cited by 158
Flagged first, then by citations
Cited by
Sorted by citations
Items 201–241 of 241
Optimizing asynchronous JavaScript applications
Turcotte, A. (2023) · doi:10.17760/d20560794
StaticTracker: A Diff Tool for Static Code Warnings
Li, J., & Yang, J. (2023) · IEEE International Conference on Software Maintenance (ICSM) · doi:10.1109/icsme58846.2023.00074
Reducing Label Errors for Actionable Warning Identification
Chen, H., Xiaocheng, C., Sun, X., Zheng, Q., & Ge, X. (2023) · IEEE International Conference on Software Quality, Reliability and Security Companion (QRS-C) · doi:10.1109/qrs-c60940.2023.00079
Customized Security Triage from Analysis Tools: Current State of the Art
Wu, Y. X., Su, J., Moran, D. D., & Near, C. D. (2023) · IEEE International Conference on Computer and Communications (ICCC) · doi:10.1109/iccc59590.2023.10507350
Limits and Difficulties in the Design of Under-Approximation Abstract Domains
Ascari, F., Bruni, R., & Roberta Gori, B. (2024) · ACM Transactions on Programming Languages and Systems · doi:10.1145/3666014
Verifying the Option Type with Rely-Guarantee Reasoning
Yoo, J., Ernst, M. D., & Just, R. (2024) · IEEE/ACM International Conference on Automated Software Engineering (ASE) · doi:10.1145/3691620.3695036
Understanding Developer-Analyzer Interactions in Code Reviews
Schäf, M., Çirişci, B., Luo, L., Mansur, M. N., Tripp, O., Sanchez, D., Zhou, Q., & Zafar, M. B. (2024) · IEEE/ACM International Conference on Automated Software Engineering (ASE) · doi:10.1145/3691620.3695257
Empirically-Informed Approaches to Shift Vulnerability Detection to the Left
Amusuo, P. C. (2025) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1109/icse-companion66252.2025.00025
FAMiT: Mitigating False Alarms for Program Analysis Using Large Language Models
Zeng, J., Li, Y., Zhang, R., Xie, Y., Li, K., & Zhou, M. Q. (2025) · Lecture notes in computer science · doi:10.1007/978-3-031-98208-8_16
Memspect: Tiny Static Analysis Framework for Real-World C Codebases
Varsha, H., Sabarish, B. A., Balashivaram, G., Malathi, P., Aathil, M. M., Srikar, S., & Resmi, R. (2025) · Lecture notes in electrical engineering · doi:10.1007/978-981-96-4679-1_11
Ryan, I., Roedig, U., & Stol, K.-J. (2025) · IEEE/ACM International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP) · doi:10.1109/icse-seip66354.2025.00054
Safe Validation of Pricing Agreements
Kolesar, J. C., Lepoint, T., Schäf, M., & Visser, W. (2025) · IEEE/ACM International Conference on Software Engineering: Software Engineering in Practice (ICSE-SEIP) · doi:10.1109/icse-seip66354.2025.00015
Fine-Tuning Large Language Models for Context-Aware Static Code Analysis and Defect Classification
Ghosh, S., & Raj, R. (2025) · Advances in computational intelligence and robotics book series · doi:10.4018/979-8-3373-4460-7.ch008 · Cited by 1
Scaling Inter-procedural Dataflow Analysis on the Cloud
Sun, Z., Zhang, Y., Wang, Y., Xu, D., Zhang, Y., Qi, Y. F., Wang, Z., Li, Y., Li, X., Lu, Q., et al. (2025) · ACM Transactions on Programming Languages and Systems · doi:10.1145/3786763
Person, T., Caballero-Hernández, J. A., Romero, C., Ruiz‐Rube, I., & Dodero, J. M. (2026) · Computers and Education Open · doi:10.1016/j.caeo.2026.100333
Knowledge distillation-driven commit-aware multimodal learning for software vulnerability detection
Mahouachi, R. (2026) · Automated Software Engineering · doi:10.1007/s10515-026-00595-z
An empirical assessment of go linters on real-world issues
Wu, J., & Clause, J. (2026) · Journal of Systems and Software · doi:10.1016/j.jss.2026.112797
Shahedi, K., Khouzam, M., Li, H., Lamothe, M., & Khomh, F. (2025) · IEEE/ACM International Conference on Automated Software Engineering (ASE) · doi:10.1109/ase63991.2025.00286 · Cited by 1
Incremental Program Analysis in the Wild: An Empirical Study on Real-World Program Changes
Wang, X., Bin, X., Huang, L., Liu, S., Zhao, J., & Bu, L. (2025) · IEEE/ACM International Conference on Automated Software Engineering (ASE) · doi:10.1109/ase63991.2025.00194
Configuration Defects in Kubernetes
Zhang, Y., Paul, U., d’Amorim, M., & Rahman, A. (2026) · IEEE Transactions on Software Engineering · doi:10.1109/tse.2026.3659785
Dai, S., Zhou, S., Wu, Y., Xi, J., & Yang, J. (2026) · Computer Physics Communications · doi:10.1016/j.cpc.2026.110124
CPGHunter: LLM-guided semantic modeling for scalable vulnerability detection via taint analysis
Hou, A., Su, B., Niu, W., Hou, Q., Wu, H., & Zhang, X. (2026) · Empirical Software Engineering · doi:10.1007/s10664-026-10842-2
Ameh, J. E., Otebolaku, A., Ikpehai, A., Shenfield, A., & Sule, D. (2026) · Research Square · doi:10.21203/rs.3.rs-9370984/v1
CodeHarbor: A Code Analysis Tool
Dewmin, T. Y., Kodithuwakku, Y. S., Dayananda, I. H. M. B. L., Fernando, K. R. A. W., Silva, D. I. D., & Rathnayake, S. J. (2026) · Lecture notes in networks and systems · doi:10.1007/978-3-032-18913-4_17
Shi, Y., Jin, Z., & Zhang, X. (2026) · Proceedings of the ACM on Programming Languages · doi:10.1145/3808351
Scaling Static Code Analysis Adoption at WhatsApp iOS
Hajdu, Á., Mendez, J., Valkenburg, S., Kupriianets, A., Marescotti, M., Churchill, D., & Cela, S. (2026) · State Of the Art in Java Program Analysis · doi:10.1145/3814987.3814990
SoK: A Modularized Framework for Symbolic Execution and Application for Usable Tool Design
Mattei, J., Lin, A., Geer, J., Hu, J., Schloegel, M., Bao, T., & Votipka, D. (2026) · IEEE Secure Development Conference (SecDev) · doi:10.1145/3805773.3805996
Amaral, L., Schlichtig, M., Emanuel, W., Almeida, J., Ferreira, C., Kempf, J., Bonifácio, R., Bodden, E., Peotta, L., Pinto, G., et al. (2026) · IEEE International Conference on Software Analysis, Evolution and Reengineering (SANER) · doi:10.1109/saner67736.2026.00039
Profiling programmer proficiency using static analysis
Pietriková, E., Horváth, M., & Baláž, A. (2026) · PeerJ Computer Science · doi:10.7717/peerj-cs.3981
Detecting Software Requirements Smells Through Domain-Augmented Generation
Aysan, O., Akyol, G., & Tüzün, E. (2026) · IEEE Annual International Computer Software and Applications Conference (COMPSAC) · doi:10.1109/compsac69091.2026.00054
Refuting Infeasible Paths for False Alarm Reduction
Chen, J., Xie, Y., Zeng, Z., Zhang, R., Tang, J., & Zhou, M. (2026) · IEEE Annual International Computer Software and Applications Conference (COMPSAC) · doi:10.1109/compsac69091.2026.00051
An Empirical Study on Static Application Security Testing (SAST) Tools for Python
Liu, Z., Wang, Z., Liu, H., & Li, W. (2026) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1145/3744916.3773110
Deininger, P., Rappl, S., Lindner, H., & Gebeshuber, K. (2026) · Journal of Cybersecurity and Privacy · doi:10.3390/jcp6050163
When FPGA Meets Dataflow Analysis: An Explorative Step
韦芳, Chen, Q., Zhang, N., Cui, J., Tan, T. H., Zuo, Z., & Li, Y. (2026) · Proceedings of the ACM on Programming Languages · doi:10.1145/3839508
IAIA: Interrupt-Aware Index Analysis for SSD Firmware
Yoo, H., & Yi, K. (2026) · doi:10.1145/3842651.3843183
Phung, T.-N., & Nguyen, V. T. (2026) · Information and Software Technology · doi:10.1016/j.infsof.2026.108363
Barista: Synthesizing Typestate Specifications with LLM Agents
Gamboa, C., Santos, P. H., Costa, R., Caetano, M., Aldrich, J., & Fonseca, A. (2026) · IEEE/ACM International Conference on Automated Software Engineering (ASE) · doi:10.1145/3832783.3834427
Nocera, S., Vegas, S., & Scanniello, G. (2026) · IEEE/ACM International Conference on Automated Software Engineering (ASE) · doi:10.1145/3832783.3834408
Position: Vibe Coding Needs Vibe Reasoning: Improving Vibe Coding with Formal Verification
Mitchell, J., & Shaaban, Y. (2025) · arXiv · Cited by 8
“Furthermore, even prior to vibe coding, industry reports show that it is difficult to get developers to adopt static analysis in their workflows [5, 11, 30, 34].”
Metadata
- Authors
- Sadowski, C., Aftandilian, E., Eagle, A., Miller-Cushon, L., & Jaspan, C.
- Affiliations
- Google (United States) (US)
- Venue
- Communications of the ACM
- Published
- 2018-03-26
- Volume
- 61
- Issue
- 4
- Pages
- 58-66
- ISSN
- 0001-0782 (ISSN-L)
- 1557-7317
- OpenAlex
- W2784876765
- Cited by
- 242
- References
- 23
- Citations by year
- 2026: 26 · 2025: 21 · 2024: 30 · 2023: 43 · 2022: 40 · 2021: 27 · 2020: 28 · 2019: 23 · 2018: 4
- FWCI
- 32.97
- Type
- journal article
- Language
- en
- Open access
- bronze
- doi.org
- Locations
- Communications of the ACM (publishedVersion)
- Topics
- Physical Sciences › Computer Science › Information Systems › Software Engineering Research
- Physical Sciences › Computer Science › Information Systems › Software Engineering Techniques and Practices
- Physical Sciences › Computer Science › Software › Logic, programming, and type systems
- Keywords
- static analysis tools, developer adoption, developer experience, software quality
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
