Static analysis reads the code without running it, which is exactly what a merge gate needs.

Linters enforce style and a narrow set of correctness rules. They are excellent at what they do and largely indifferent to whether a key is committed, an interpolation is escaped or a catch block is empty.

Security scanners cover some of that, but they assume a repository, a build and a pipeline. The moment where generated code is most dangerous is earlier: the snippet in an editor, the file pasted from a chat window.

Static analysis of the kind that helps here is a rule set applied to text, cheap enough to run at every point where code is copied.

Anything visible in the source is in scope, and that is a longer list than people expect.

No text-level analysis knows whether a method exists on your installed version, whether two modules are compatible, or whether an endpoint is idempotent.

It cannot tell you a null is possible, that a promise rejects, or that the authorisation check on the route above yours is missing. Those need types, tests and a reader who knows the system.

It also cannot tell you whether the design is right. A function can be free of every finding and still be the wrong abstraction.

Block on the categories where shipping is inexcusable: credentials, unsafe rendering of untrusted input, shell and SQL concatenation, source that does not parse.

Warn on residue, long lines, loose equality and missing alt text. Those are real and rarely urgent, and treating them as blockers trains people to override the gate.

Review the block list quarterly. A rule that fires on legitimate code is worse than a missing rule, because it undermines the ones that matter.

Three placements cover the lifecycle. At authoring, when a snippet is pasted, where the fix is free. At review, when the report attaches to the pull request. In CI, where repository-wide and historical scanning belongs.

Each placement needs a different tool. The first has to be instant and require no setup; the third has to see the whole repository and its history.

The mistake is assuming one placement covers the others. A pipeline scan does not stop the key from being typed; a paste-time check does not find what was committed last year.

Triage by category, not by count. Four critical findings matter more than forty low ones, which is why severity weighting exists.

Disagree with a rule in writing. A pattern that fires on a test fixture is an exemption to record, and a pattern that fires on legitimate framework code is a rule to fix upstream.

For production-bound changes with real risk, hand the report to a named reviewer who reads for design and integration. The analysis removes the mechanical work from their hour, which is the most useful thing it can do.