Static analysis earns IEEE recognition at Meta

Meta's security engineering teams have received the 2021 IEEE Computer Society Cybersecurity Award for Practice, honoring their work developing and deploying static analysis systems such as Infer and Zoncolan. The award reflects a decade-long investment in tools that scan code for security vulnerabilities at scale—an approach that was once viewed skeptically by the industry.

Static analysis has become central to Meta's security workflow because of the sheer volume of code changes the company processes daily. With large codebases changing thousands of times per day, manual review cannot keep pace. The company's approach pairs static analysis experts with security engineers, creating a feedback loop that has helped identify and eliminate entire classes of vulnerabilities. During the first half of 2021, more than 50 percent of security bugs found at Meta were detected with the help of these automated tools.

From detection to prevention across languages

Meta has open-sourced several of its static analysis tools, recognizing that shared code libraries across the industry create shared security interests. The tools are tailored to specific languages and deployment scenarios:

  • Zoncolan for Hack: Built by analyzing databases of past bug bounty reports, root causes, and corresponding fixes. When a new issue class is discovered, engineers evaluate whether static analysis offers the best detection approach compared with alternatives like fuzzing or the Invariant Detector. Each new rule is validated by a security engineer against initial results to confirm accuracy and minimize false positives. Zoncolan now blocks commits flagged as insecure with high confidence and continuously identifies potentially risky code for investigation.
  • Pysa for Python: Developed after Zoncolan's success, Pysa was designed for the millions of lines of Python code powering Instagram's servers. When run on a proposed code change, Pysa returns results in about an hour compared with the weeks or months manual review could take. Results are routed to developers or security engineers depending on the issue type and detection confidence.
  • Mariana Trench for Java and Android: Focused on mobile codebases, Mariana Trench addresses the unique challenge of Android security: fixing a server-side bug requires no user action, but patching a mobile vulnerability depends on users installing updates. The tool scans large mobile codebases and flags issues on pull requests before they reach production.

One layer among many

Static analysis is not treated as a complete solution at Meta. The company pairs it with runtime program analysis, which monitors program and data behavior for anomalies; traditional code reviews examining architecture and documentation; and bug bounty programs that identify and patch vulnerabilities before public disclosure. This defense-in-depth approach acknowledges that no single technique catches every issue. Meta continues to contribute tools and findings to the open source community as part of its broader security efforts.