Zoncolan: How Facebook uses static analysis to detect and prevent security issues

This post introduces Zoncolan, a static analysis tool developed by Facebook to detect and prevent security and privacy issues in its large Hack codebase. Zoncolan uses abstract interpretation to track user-controlled input from sources to sinks, identifying potentially dangerous data flows. It allows security engineers to quickly verify findings, codify rules to prevent future occurrences, and serves as documentation for issue classes. The tool analyzes the entire codebase in under 30 minutes and has prevented thousands of potential security issues, with a significant portion flagged directly to code authors before landing.