Skip to main content
Static analysis is a Superblocks-managed Code Security policy that inspects your application source and built artifacts before publish. It runs Semgrep against the snapshot being published. It is deterministic: the same code always produces the same findings. There is no configuration beyond enabling it and choosing a scan mode. Superblocks maintains the rules and normalizes results into findings.

​
What it scans

Findings fall into these categories. Superblocks maintains the Semgrep rule packs behind them and adds to them over time. Built-asset scanning is the authoritative gate for secrets. It checks the final bundle that would ship to production, not just the source, so a secret is caught regardless of how it reached the build output. It is also what decides blocking: a finding in the built assets can block a publish, while a finding in source alone is reported without blocking. Static analysis reports what it can see in the code itself. Issues that depend on application logic, such as an endpoint that skips an authorization check or returns another user’s data, are the Security Agent’s job.

​
When it runs

Static analysis runs at publish time, after the application is built and before it deploys. It evaluates the exact artifact that would ship, so there is no gap between what was checked and what was deployed. Builders do not trigger scans manually. The scan runs in the background and results appear under Pre-Publish Policies on the publish detail.

​
How it compares

The two are complementary and run in parallel. For dependency and package advisories, see CVE detection.

​
Findings and enforcement

Severity, scan modes, remediation with Fix with Clark, run errors, and the audit trail are the same for every publish-time policy. See How findings work.