Static analysis is an alternative approach to penetration testing, which focus on analysing source code,rather than attacking running applications. I developed a prototype static analysis tool, and learnedall sorts about static analysis and secure coding on the way. I will explain the basic principles of staticanalysis, the practical problems you hit, and the lessons for secure development pracitces. This willbe useful for people who use static analysis tools, perform code analysis, and developers interested insecurity.