Facebook has built a static analysis platform, dubbed Zoncolan, that can scan Facebook's 100M lines of code in under 30 minutes to help catch bugs
FACEBOOK DOESN'T HAVE the most stellar privacy and security track record, especially given that many of its notable gaffes were avoidable. Tweets: @wired , @wired , and @trustedsec Tweets: @wired : Four years ago, Facebook engineers began building an assessment tool that checks for known types of bugs and can fully scan its entire codebase in under 30 minutes—helping engineers catch issues in tweaks, changes, or major new features before they go live https://www.wired.com/... @wired : With billions of users and a gargantuan platform to defend, it's not easy to catch every flaw in 100 million lines of code. So Facebook built a tool that not only checks for known types of bugs, but fully scans the entire codebase in under 30 minutes https://www.wired.com/... @trustedsec : Source code analyzers play a vital role, CEO @HackingDave tells @wired, but can't prevent the policy-based privacy problems that caused some of Facebook's most serious data breaches. https://www.wired.com/...
Context & Ripple Effects
Zoncolan is one layer in a stack Facebook has been assembling since at least 2015, when it put every new product and code change through a systematic privacy review process. In 2018 it added SapFix, an AI tool that not only finds bugs but tests and proposes patches (SapFix deployment), and hired an internal team to hunt vulnerabilities before attackers do.
What Zoncolan adds is scale and speed: a static analyzer that sweeps all 100 million lines in under 30 minutes, meaning no change ships unscanned. The payoff was visible a year later when Facebook open-sourced its Python analyzer Pysa, which had caught 44% of Instagram's server-side security bugs in half of 2020 (Pysa open-sourcing) — evidence the approach works well enough to give away.
First-order effects
- Facebook's own engineers get pre-deploy detection of known bug classes across the full codebase, shrinking the window between introducing a flaw and catching it from post-launch incident to commit-time warning.
Second-order effects
- The tooling proved exportable: Facebook extended the same static-analysis approach to Python and released it publicly as Pysa, turning an internal defense into developer-community infrastructure and a recruiting signal.
- Rivals defending comparably large codebases face pressure to match scan-everything speed or accept a higher residual-bug rate — a gap that shows up as their avoidable incidents.
Third-order effects
- Application security is shifting from periodic audits and red-team sprints toward always-on, codebase-wide automated scanning, with human offensive teams like Red Team X reserved for what static rules can't see.
- If the pattern holds, the differentiator among large platforms becomes enforcement coverage — how much of the codebase is scanned, how fast — rather than the size of the security team.
The trend: Large-platform security is consolidating around internally built, continuously running static analysis platforms whose speed makes full-codebase scanning routine rather than episodic.