Static analysis for secure code. Run Semgrep rules on diffs to catch vulnerabilities before commit.