Semgrep

Also written: semgrep scan

A static analyzer for many languages that takes your own code-shaped rules, such as kc-sql-built-from-strings matching $DB.execute("..." + $X).

Where the book teaches it