PVS-Studio

PVS-Studio is a static code analyzer and SAST tool for C, C++, C#, Java, Go, JavaScript and TypeScript teams, installed on-premise and able to run offline.

PVS-Studio finds bugs and security weaknesses in source code by reading the code without running it. It is developed by PVS-Studio LLC, an independent company in Astana, Kazakhstan. Developers run it on their own machines, build servers run it on every change, and pipelines use its results to decide whether a build passes. Its diagnostics catch logic errors and suspicious constructs as well as security flaws such as SQL injection, XXE and XSS. Mapping tables tie the warnings to CWE, OWASP ASVS and SEI CERT, and an OWASP diagnostic group for C++, C# and Java includes a check for credentials stored in code. Software composition analysis looks for vulnerable components inside the application. Baselining hides the warnings already present in old code, so a team sees only what each change introduces. Project-level .pvsconfig files switch diagnostics off or change their certainty level, and the PVS-Studio server applies quality gates with thresholds per severity. The analyzer is made for development teams writing C, C++ and C#, with Java, Go, JavaScript and TypeScript covered as well. Game studios use it on Unreal Engine projects. Organisations that answer to MISRA, AUTOSAR, CWE or OWASP requirements use its standard mappings when they need to show how their code measures up. Security teams add it to an existing build to bring code and component checks into one step. Developers start an analysis from plugins for Visual Studio, JetBrains Rider, CLion, IntelliJ IDEA and VS Code, or let incremental analysis check the files touched by each build. On the server side, commit and merge request mode analyses only modified files in Jenkins, GitHub Actions, GitLab CI/CD, Azure DevOps or TeamCity. Results can go to GitHub code scanning, where a pull request check holds the merge until the warnings are dealt with. Teams that already track findings in SonarQube or DefectDojo export the reports there, and personalised email notifications send each developer the warnings found in their own code. For a team that wants every merge request read for defects before review, PVS-Studio becomes a standing step of the pipeline rather than an occasional audit.