They say that they do both, though. First static analysis, then also log whatever requests that analysis missed, so that they can add it later on. And they als

They say that they do both, though. First static analysis, then also log whatever requests that analysis missed, so that they can add it later on. And they also add the static analysis to their CI pipeline, so that it can be checked then and there, not by obscure "happens once every half year during runtime" integration with a very uncommon service that they don't build very often.