prefast

Prefast, often styled PREfast, is a static analysis tool developed by Microsoft for C and C++ code. It analyzes source code to detect programming mistakes that could lead to security vulnerabilities, memory corruption, resource leaks, or other runtime failures. The tool operates at compile time, inspecting function calls, return codes, memory management, and API usage, and it can examine code paths that are difficult to validate with dynamic testing.

Prefast relies on code annotations, such as SAL (Source Annotation Language), to express intended behaviors, preconditions, postconditions, and resource ownership. These annotations help the analyzer reason about pointers, buffers, and object lifetimes, enabling more precise warnings. Warnings are surfaced through the build process and can be managed with rule sets, suppression comments, or per-project configuration.

Historically, PreFast was distributed with Microsoft development tools and was widely used in Windows and driver development to catch defects early. In later years, its functionality was integrated into Visual Studio's Code Analysis (Static Analysis) tools and aligned with the /analyze switch, while the separate PreFast branding faded from active use. Some teams continue to rely on legacy PreFast workflows or on modern equivalents for C/C++ static analysis.

Limitations include potential false positives and the need for careful annotation. As static analysis capabilities evolved, many projects migrated to newer analyzers based on clang-tidy, PVS-Studio, or the built-in Visual Studio analyzers, but PreFast remains part of the historical foundation of Microsoft's static analysis approach.