static-analysis
(16)
Bryan Helmkamp and the trouble with good code
Good developers can still leave difficult software behind. From Code Climate to Qlty, Bryan Helmkamp has built a career around making the next change easier - and the evidence easier to use.
Swimm wants your old code to explain itself
The company that made documentation follow the code now delivers legacy modernization. Its wager: before AI can change a system safely, someone must establish what the system actually does.
Parasoft and the Art of Not Waiting
A bank loses five days a month waiting to test its software. Parasoft’s answer is to build a convincing substitute for the system everyone is waiting for - and get on with the work.
SDF Labs and the expensive art of finding out too late
A Seattle compiler startup asked why data developers had to send SQL to the cloud just to discover a mistake. Its answer ended up inside dbt - and changed the machinery beneath analytics engineering.
Sam Blackshear and the Art of Making Bugs Harder to Write
He built Move to give digital assets the rules that physical objects already have. After taking that idea from Meta to Sui, the engineer has turned back toward the problem that started his career: finding flaws before anyone can use them.
Black Duck Came Back From a $2.1 Billion Detour - Now It Wants to Police the AI Code Rush
The open source scanner sold for $565 million, disappeared inside Synopsys, then returned as the name of a $2.1 billion security business. Its next test is harder: checking code that machines can write faster than humans can review.
Code Climate
Code Climate is a New York-based software engineering intelligence company founded in 2011. It began with automated code review and quality analysis, grew into Velocity - an analytics platform that gives engineering leaders visibility into delivery, DORA metrics and team health - and has since repositioned around helping enterprise leaders measure and manage AI-native engineering transformation, pairing a data platform with Forward Deployed Engineers.
Veridise
Veridise is an Austin-based blockchain security company spun out of the UToPiA program-analysis research group at the University of Texas at Austin. It hardens Web3 by pairing expert human auditors with proprietary tools built on formal methods, fuzzing and program analysis. Veridise audits smart contracts, zero-knowledge circuits, blockchain implementations and dApps, and has completed 150+ audits for infrastructure protocols including Scroll, Linea, Succinct, Manta Network, RISC Zero and Semaphore.
Jon Stephens
Jon Stephens is the CEO and co-founder of Veridise, an Austin-based blockchain security firm that brings academic formal verification to smart contract and zero-knowledge audits. A computer science PhD researcher at UT Austin, he built tools like SmartPulse and Zequal that grew out of his work on formally reasoning about programs, and turned that research into a company that has audited protocols including RISC Zero, Succinct, Semaphore, vLayer and Ankr. His mission is to make everyday users secure without asking them to think about security at all.
Binarly
Binarly is a firmware and software supply chain security company that reads the code no one else looks at - the layer below the operating system. Its AI-powered Transparency Platform analyzes firmware binaries to surface known and unknown vulnerabilities, malicious implants, misconfigurations and cryptographic weaknesses, then builds a genuine software bill of materials by reconstructing dependencies from the binary itself rather than trusting a manifest. Founded in 2021 by veteran reverse engineers Alex Matrosov and Claudiu Teodorescu, the company has disclosed hundreds of high-impact firmware vulnerabilities, including the widely covered PKfail Secure Boot flaw.
Perforce Software
Perforce Software builds the version control, DevOps, and quality tools that large engineering teams lean on when their codebases and binary assets grow too big for ordinary tools. Its flagship - Helix Core, rebranded P4 in 2025 - moves enormous game studios, semiconductor designers, automakers, and defense programs along, while a portfolio gathered through acquisitions (Puppet, Perfecto, Delphix, Klocwork, Gliffy and more) extends from source control into static analysis, test automation, infrastructure automation, and test data management. Founded in 1995 and now backed by Clearlake Capital and Francisco Partners, Perforce powers more than half of the Global 500.
CodeRabbit
CodeRabbit is an AI-powered code review platform that reads every pull request, leaves line-by-line feedback, and helps engineering teams keep up with code now being written largely by other AIs. Founded in 2023 and headquartered in San Francisco, it serves more than 10,000 organizations including Chegg, Groupon, and Mercury.
Bito
Bito is a San Francisco-based AI developer tools company building agents that review pull requests and ground code generation in deep codebase context. Its AI Code Review agent plugs into GitHub, GitLab, and Bitbucket to flag bugs, security issues, and style problems before humans burn a single brain cell on them - and it speeds up PR merges by 89%, according to the company.
Semgrep
Semgrep is a San Francisco application-security company that builds a unified AppSec platform (Code/SAST, Supply Chain/SCA, and Secrets) used by engineering teams at Dropbox, Figma, Snowflake and others. Born out of an open-source tool originally written at Facebook, it lets security teams write code-like rules and ship them through CI - cutting false positives and pushing fixes back to developers.
Isaac Evans
Isaac Evans is the Founder and CEO of Semgrep, the developer-first application security platform that has redefined how modern engineering teams handle code security. An MIT-trained computer scientist with a background in U.S. Department of Defense security research, Evans co-founded Semgrep in 2017 with college roommates Drew Dennison and Luke O'Malley. Under his leadership, Semgrep grew from a niche static analysis tool into a platform scanning 75+ million code repositories annually, serving customers like Figma, Dropbox, Slack, and Snowflake. In February 2025, the company closed a $100M Series D led by Menlo Ventures, bringing total funding to $193M. Evans's core thesis - that security must serve developers, not obstruct them - has made Semgrep a defining force in the AppSec category.
ZeroPath
ZeroPath is an AI-native application security platform that automatically finds and fixes software vulnerabilities. Founded in 2024 by four security and engineering veterans - including a former Google Security Engineer and a former Tesla Red Team engineer - ZeroPath replaces noisy legacy SAST tools with an LLM-powered engine that understands code semantics, verifies exploitability, and generates working patches. Within a year of launch, over 1,000 organizations trust ZeroPath to scan more than 200,000 codebases per month.