← VCE Software Development U4O2

Automated code analysis tools

Tools that scan source code or dependencies for known insecure patterns and vulnerable components. They support, but do not replace, human code review.

Part of: VCE Software Development - U4O2 - Cyber Security: secure software development practices — Module 63

Understanding Automated code analysis tools in VCE Software Development U4O2

What it does: A false positive is a warning about a problem that does not really exist, which is why humans must review the results. Combining automated scanning with peer review catches both known patterns and logic flaws the tool cannot understand. Static analysis reads the code as written, so it can find issues such as hard-coded secrets or unsafe SQL building before the software is run. Dependency scanning compares the libraries and versions your project uses against lists of known vulnerabilities. Tools match patterns without fully understanding context, so some alerts are wrong and some real issues may be missed. Tools only detect what they are built to recognise. Unknown flaws and design or logic errors can still be present.

Common mistakes: A Python for loop header must end with a colon. The static analysis loop should be: for line in source_lines:. Looping over a dictionary gives only the keys, so name, ver cannot be unpacked. The dependency scan needs deps.items() to get each name and version pair.

Class: _____________________ · Name: _____________________ · Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Automated code analysis tools to a class →

This module's key terms are also in a printable crossword (Modules 49–72) and word search (Modules 49–130).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning

Duo

What does an automated code analysis tool do?

Rewrites the whole program so it can never be attackedScans source code or dependencies for known insecure patterns and vulnerable components

Matches

Scan passed with no warnings, so skip code review

↓

Treating a clean scan as proof the code is secure. Tools only detect known patterns and miss logic flaws, so human review is still needed.

Applying

Meanings

Term

automated code analysis

Meaning

Tools that scan source code or dependencies for known insecure patterns and vulnerable components. They support, but do not replace, human code review.

Practice

FOR each file IN sourceFiles

Testing

Gaps

report ← Analysis("src/")

Check Answer

Spots

1patterns = ["eval(", "exec("]

2for line in source_lines

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy

Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games

Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print

Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. What does an automated code analysis tool do?

A. Scans source code or dependencies for known insecure patterns and vulnerable components ✓

B. Rewrites the whole program so it can never be attacked

Automated tools look for known problems, such as insecure patterns and vulnerable components. They do not guarantee that software is secure.

2. Which statement about automated analysis and human code review is correct?

A. Automated tools replace the need for human review

B. Automated tools support human review but do not replace it ✓

Tools are fast and consistent but miss logic flaws and context. A person still needs to review the code.

3. Static analysis examines code in which way?

A. It checks the source code without running the program ✓

B. It only checks the program while users are running it

Static analysis reads the code as written, so it can find issues such as hard-coded secrets or unsafe SQL building before the software is run.

4. Which problem is a static analysis tool likely to flag?

A. A hard-coded password in the source code ✓

B. A user who chooses to share their login with a friend

A hard-coded password is a pattern in the code that a tool can detect. A user's behaviour cannot be seen in the source code.

5. What does dependency scanning check?

A. Whether the variable names in your own code are easy to read

B. Whether third-party libraries used by the project have known vulnerabilities ✓

Dependency scanning compares the libraries and versions your project uses against lists of known vulnerabilities.

Match the Pairs

Static analysis scan → Checks source code without running it, looking for known insecure patterns such as unsanitised input

Dependency scan → Compares the libraries a project uses against lists of known vulnerable versions

A tool flags a line of code as a risk, but a developer checks and finds it is actually safe → False positive

Automated tools support human code review but do not replace it, because they only find known patterns → Scan + peer review

Scan passed with no warnings, so skip code review → Treating a clean scan as proof the code is secure. Tools only detect known patterns and miss logic flaws, so human review is still needed.

Warning found: delete it, it must be a false positive → Ignoring a warning without investigating it. Each result should be checked by a person to decide whether it is a real vulnerability or a false positive.

Key Term

automated code analysis

Tools that scan source code or dependencies for known insecure patterns and vulnerable components. They support, but do not replace, human code review.

Fill in the Blanks

1. report ← staticAnalysis("src/")

Hint: Type the kind of analysis that examines source code for insecure patterns without running the program.

2. results ← dependencyScan("package.json")

Hint: Type the word (singular) for the third-party packages this scan checks for known vulnerable versions.

3. IF finding.confirmed = FALSE THEN markAsFalsePositive(finding) END IF

Hint: Type the Boolean value that shows a human reviewer did not confirm the tool's warning.

4. releaseOk ← scanOk AND reviewOk

Hint: Type the logical operator that requires both the tool result and the human review to pass.

5. npm audit --production

Hint: Type the npm subcommand that checks installed packages for known vulnerabilities.

Spot the Error

Question 1

A patterns = ["eval(", "exec("]

B for line in source_lines

C for p in patterns:

D if p in line:

E report(line)

Line B — A Python for loop header must end with a colon. The static analysis loop should be: for line in source_lines:

Question 2

A bad = {"libx": "1.0"}

B for name, ver in deps:

C if bad.get(name) == ver:

D print("Update", name)

Line B — Looping over a dictionary gives only the keys, so name, ver cannot be unpacked. The dependency scan needs deps.items() to get each name and version pair.

Question 3

A for f in findings:

B real = human_check(f)

C if real:

D ignore(f)

E else:

F mark_false_positive(f)

Line D — If a person confirms the finding is real, it must be fixed, not ignored. Only false positives should be dismissed. The line should be fix(f).

Question 4

A report = static_scan(app.py)

B for issue in report:

C print(issue.line)

Line A — The file name is a string, so it needs quotes. Without them Python looks for a variable called app and fails. It should be static_scan("app.py").

Question 5

A define scan(code, rules):

B found = []

C for r in rules:

D if r in code:

E found.append(r)

F return found

Line A — Python functions are declared with the keyword def, not define. The line should be def scan(code, rules):

Student with a class code? Join your class →