Static analysis

Static analysis combines TypeScript strictness, dependency boundary checks, security scanners, dead-code detection, and custom architectural rules. It finds whole-class defects before runtime: unsafe casts, missing exhaustiveness, forbidden imports, and known vulnerable dependency versions. The goal is fast feedback with low false-positive fatigue.

On interviews: compare compiler errors, lint rules, and deeper analyzers like dependency-cruiser or Semgrep. Explain triage when signal is noisy.

Common pitfalls: running analyzers only locally; ignoring findings in legacy folders forever; rules without owners or rollback plan.

The trade-off is flexibility versus complexity—know when the simpler path is enough.

Checklist:

• Layer checks from fast local to slower CI jobs.
• Track analyzer versions and baselines.
• Assign owners for new rule categories.
• Tie high-severity findings to merge blockers.