Axiom JDK has integrated the Svace static analysis tool and the Svacer alert management platform, both developed by the Ivannikov Institute for System Programming of the Russian Academy of Sciences. This implementation was necessary to ensure the JDK meets updated security certification requirements, specifically GOST R 71207-2024.
During the analysis of 7 million lines of code, the team identified and corrected approximately 1,200 defects. Axiom JDK adopted a multi-layered security approach, combining Svace for deep interprocedural analysis with various other SAST tools and open-source linters to maximize defect detection coverage.
To manage the high volume of alerts, the company implemented Svacer alongside machine learning classification tools. This workflow allows developers to efficiently filter critical vulnerabilities from low-priority issues. Currently, each developer processes an average of 50 alerts per day using this system.
