> static analyser working using only an understanding of the language [...] looking over the ast The part I quoted is called "tainting". Or if you are more aca

> static analyser working using only an understanding of the language [...] looking over the ast The part I quoted is called "tainting". Or if you are more academically inclined, "data flow analysis". When it works right, it is an incredible force multiplier in security. You get detailed, actionable and above all helpful error messages directly from CI, because as a static analysis tool it's pretty fast and can be made part of the common linting pass. As you hinted, it does require a suitable config setup and/or code annotations to mark sources and sinks. And when it does work, it can eliminate an entire class of vulnerabilities - good taint analysis will prevent you from even accidentally using user-supplied data in anything that involves relaying, storing or displaying information. The downside is, when it doesn't work, it's a source of unhappiness. Debugging a taint failure because the AST analysis gives a false positive can be infuriating.