Tailor Deep Static Analysis to Your Unique Codebase

Create custom function specifications, write your own checkers, and track complex data flows using the powerful Svace API. Cover proprietary libraries, custom frameworks and internal functions to extend detection scope and reduce false results, both positive and negative.

SAST that Understands Your Code

001

Model Unidentified Code with Function Specifications

Function Specifications are compact function definitions written in the same language as your codebase (C/C++, Java, Go, etc.).

How it works: You define the critical behavior (e.g., "this function unconditionally dereferences its first argument").

Outcome: Svace prioritizes your specification over its default analysis. It will accurately flag a null-pointer dereference, even if the library's source code is completely hidden from the scanner.

Build Custom Checkers with the Svace API

Enforce your organization's unique coding standards and catch domain-specific vulnerabilities. The public Svace API allows you to write custom plugins that integrate seamlessly into the analysis engine via the Java Module System (Java 9+).

User-generated checkers combine Code Entities (operators, operands) with Patterns (predicates that evaluate conditions). Because the API uses hierarchical entity matching, your custom checkers automatically adapt as the Svace engine evolves, requiring zero maintenance.

Track Complex Flaws with Custom Attributes

Single-instruction checks aren't enough for modern software. To find defects that span multiple instructions or functions, the Svace API lets you create Custom Attributes.

How it works: Your plugin can "tag" a specific value with an attribute during one instruction. Svace's engine automatically propagates this attribute through the program's data flow (e.g., across variable assignments).

Outcome: Your custom checker can later check for that attribute downstream, allowing you to catch multi-step logical vulnerabilities that other checkers miss.

Why Customize SAST

002

Eliminate False Positives

Teach Svace the quirks of your legacy codebase or custom memory allocators, drastically reducing noise and alert fatigue.

Secure Proprietary Tech Stacks

Don't let closed-source internal libraries become blind spots. Model them once, and secure them forever.

Enforce Internal Standards

Go beyond CWE and OWASP. Write checkers that specifically target your company's unique architectural anti-patterns.

Future-Proof Your Security

Because custom plugins hook into Svace's unified intermediate representation, they remain robust and effective as your codebase scales and evolves.