Static Analysis Tooling

4 posts · Apr 2017 – Feb 2023

What this trail covers

This thread tracks the evolution of static analysis tooling at Slack, focusing on improving code quality, security, and developer productivity. Initial posts detailed the adoption of Hack and the need for more advanced type checking. This post details the adoption of TypeScript for the desktop application's JavaScript codebase, enabling static type checking to catch bugs early, improve code maintainability, and enhance editor integration for better developer productivity. The team also implemented pre-commit hooks with TSLint and the TypeScript compiler to ensure code quality before commits and pushes.

All Slack trails

Feb 2023Hakana: Taking Hack SeriouslyThis post introduces Hakana, a new open-source static analysis tool for Hack, developed at Slack. It details Hakana's technical foundation (based on Psalm, written in Rust, using Hack parser), its usage in CI for code behavior enforcement (unused code, type checks, security vulnerabilities, internal API misuse), its security analysis capabilities (interprocedural and intraprocedural analysis, literal string types for SQL injection prevention), its extensibility via plugins, and its performance benefits (5x faster than Psalm). It also explains the rationale for open-sourcing Hakana.
Nov 2021How Two Interns Are Helping Secure Millions of Lines of CodeThis post details the work by two interns to extend Semgrep to support the Hack programming language. This involved developing a grammar for Hack using Tree-sitter, creating a CST, and then mapping the CST to Semgrep's AST using a custom OCaml parser. The goal was to enable Semgrep's pattern matching capabilities for security vulnerability detection in Slack's Hack codebase. The work resulted in a high parse rate for both the grammar and the parser, and the Hack grammar was open-sourced.
Apr 2020Hacklang at Slack: A Better PHPThis post details the migration to Hacklang, a superset of PHP, to improve developer productivity through better tooling, a stronger type system, and static type checking. It highlights the benefits of static typing for catching bugs early, the use of gradual typing for incremental migration, and the introduction of 'shapes' for representing complex data structures. The post also discusses the advantages of async/await for concurrency and the decision to break PHP compatibility to enable Hack's growth.
Apr 2017TypeScript at SlackThis post details Slack's adoption of TypeScript for its Electron desktop application. It explains the benefits of static type checking over JSDoc for catching bugs, improving code self-documentation, and enhancing editor autocompletion. The migration process involved gradual typing, leading to the discovery of numerous small bugs. The post also highlights the importance of editor integration and the availability of type definitions for third-party libraries. Pre-commit hooks with TSLint and the TypeScript compiler are used to enforce code quality and structural soundness.
Advertisement