diff --git a/Makefile b/Makefile
index 237488bb..c95d4299 100644
--- a/Makefile
+++ b/Makefile
@@ -121,6 +121,9 @@ $(APP_OBJS): CFLAGS += \
 	-Ideps/xopt \
 	-Wdouble-promotion \
 	-Werror
+$(info $(filter-out $(BUILD_DIR)/android,$(APP_OBJS)))
+$(filter-out $(BUILD_DIR)/android%,$(APP_OBJS)): CFLAGS += \
+	-fanalyzer
 
 BLOWFISH_SOURCES := \
 	deps/crypt_blowfish/crypt_blowfish.c \
diff --git a/src/main.c b/src/main.c
index c9f54d1f..b1dece98 100644
--- a/src/main.c
+++ b/src/main.c
@@ -151,10 +151,6 @@ static int _tf_command_test(const char* file, int argc, char* argv[])
 	int extra_count = 0;
 	const char *err = NULL;
 	XOPT_PARSE(file, XOPT_CTX_KEEPFIRST | XOPT_CTX_STRICT, options, &args, argc, (const char**)argv, &extra_count, &extras, &err, stderr, "test [options]", "options:", NULL, 15);
-	if (extras)
-	{
-		free((void*)extras);
-	}
 	if (err)
 	{
 		fprintf(stderr, "Error: %s\n", err);
@@ -167,6 +163,10 @@ static int _tf_command_test(const char* file, int argc, char* argv[])
 		.tests = args.tests,
 	};
 	tf_tests(&test_options);
+	if (extras)
+	{
+		free((void*)extras);
+	}
 	return 0;
 xopt_help:
 	if (extras)
@@ -197,7 +197,6 @@ static int _tf_command_import(const char* file, int argc, char* argv[])
 	int extra_count = 0;
 	const char *err = NULL;
 	XOPT_PARSE(file, XOPT_CTX_KEEPFIRST | XOPT_CTX_POSIXMEHARDER | XOPT_CTX_STRICT, options, &args, argc, (const char**)argv, &extra_count, &extras, &err, stderr, "import [options] [paths] ...", "options:", NULL, 15);
-
 	if (err)
 	{
 		fprintf(stderr, "Error: %s\n", err);
@@ -258,14 +257,9 @@ static int _tf_command_export(const char* file, int argc, char* argv[])
 	int extra_count = 0;
 	const char *err = NULL;
 	XOPT_PARSE(file, XOPT_CTX_KEEPFIRST | XOPT_CTX_POSIXMEHARDER | XOPT_CTX_STRICT, options, &args, argc, (const char**)argv, &extra_count, &extras, &err, stderr, "export [options] [paths] ...", "options:", NULL, 15);
-
 	if (err)
 	{
 		fprintf(stderr, "Error: %s\n", err);
-		if (extras)
-		{
-			free((void*)extras);
-		}
 		return 2;
 	}
 	tf_ssb_t* ssb = tf_ssb_create(NULL, NULL, args.db_path);
@@ -409,16 +403,8 @@ static int _tf_command_run(const char* file, int argc, char* argv[])
 	if (err)
 	{
 		fprintf(stderr, "Error: %s\n", err);
-		if (extras)
-		{
-			free((void*)extras);
-		}
 		return 2;
 	}
-	if (extras)
-	{
-		free((void*)extras);
-	}
 
 	int result = 0;
 #if !defined(_WIN32) && !defined(__MACH__)
@@ -454,6 +440,10 @@ static int _tf_command_run(const char* file, int argc, char* argv[])
 		tf_free(threads);
 	}
 
+	if (extras)
+	{
+		free((void*)extras);
+	}
 	return result;
 
 xopt_help:
@@ -481,20 +471,11 @@ static int _tf_command_sandbox(const char* file, int argc, char* argv[])
 	int extra_count = 0;
 	const char *err = NULL;
 	XOPT_PARSE(file, XOPT_CTX_KEEPFIRST | XOPT_CTX_POSIXMEHARDER | XOPT_CTX_STRICT, options, &args, argc, (const char**)argv, &extra_count, &extras, &err, stderr, "sandbox [options]", "options:", NULL, 15);
-
 	if (err)
 	{
 		fprintf(stderr, "Error: %s\n", err);
-		if (extras)
-		{
-			free((void*)extras);
-		}
 		return 2;
 	}
-	if (extras)
-	{
-		free((void*)extras);
-	}
 
 #if !defined(_WIN32) && !defined(__MACH__)
 	prctl(PR_SET_PDEATHSIG, SIGHUP);
@@ -505,6 +486,10 @@ static int _tf_command_sandbox(const char* file, int argc, char* argv[])
 	/* The caller will trigger tf_task_activate with a message. */
 	tf_task_run(task);
 	tf_task_destroy(task);
+	if (extras)
+	{
+		free((void*)extras);
+	}
 	return 0;
 
 xopt_help:
@@ -533,10 +518,6 @@ static int _tf_command_check(const char* file, int argc, char* argv[])
 	XOPT_PARSE(file, XOPT_CTX_KEEPFIRST | XOPT_CTX_STRICT, options, &args, argc, (const char**)argv, &extra_count, &extras, &err, stderr, "check [options]", "options:", NULL, 15);
 	if (err)
 	{
-		if (extras)
-		{
-			free((void*)extras);
-		}
 		fprintf(stderr, "Error: %s\n", err);
 		return 2;
 	}
diff --git a/src/mem.c b/src/mem.c
index 1379d997..428bcdd9 100644
--- a/src/mem.c
+++ b/src/mem.c
@@ -207,6 +207,10 @@ tf_mem_allocation_t* tf_mem_summarize_allocations(int* out_count)
 	return result;
 }
 
+#if defined(__GNUC__)
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wanalyzer-malloc-leak"
+#endif
 static void* _tf_alloc(int64_t* total, size_t size)
 {
 	size_t overhead = sizeof(size_t);
@@ -302,6 +306,9 @@ static void* _tf_realloc(int64_t* total, void* ptr, size_t size)
 		return NULL;
 	}
 }
+#if defined(__GNUC__)
+#pragma GCC diagnostic pop
+#endif
 
 static void _tf_free(int64_t* total, void* ptr)
 {
@@ -327,6 +334,10 @@ static void* _tf_uv_realloc(void* ptr, size_t size)
 	return _tf_realloc(&s_uv_malloc_size, ptr, size);
 }
 
+#if defined(__GNUC__)
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wanalyzer-malloc-leak"
+#endif
 static void* _tf_uv_calloc(size_t nmemb, size_t size)
 {
 	size_t total_size = nmemb * size;
@@ -361,6 +372,9 @@ static void* _tf_uv_calloc(size_t nmemb, size_t size)
 		return NULL;
 	}
 }
+#if defined(__GNUC__)
+#pragma GCC diagnostic pop
+#endif
 
 static void _tf_uv_free(void* ptr)
 {
@@ -421,7 +435,10 @@ char* tf_strdup(const char* string)
 {
 	size_t len = strlen(string);
 	char* buffer = tf_malloc(len + 1);
-	memcpy(buffer, string, len + 1);
+	if ( buffer)
+	{
+		memcpy(buffer, string, len + 1);
+	}
 	return buffer;
 }
 
diff --git a/src/ssb.c b/src/ssb.c
index e3163f3e..5952b6da 100644
--- a/src/ssb.c
+++ b/src/ssb.c
@@ -1050,8 +1050,8 @@ bool tf_ssb_id_bin_to_str(char* str, size_t str_size, const uint8_t* bin)
 bool tf_ssb_id_str_to_bin(uint8_t* bin, const char* str)
 {
 	const char* author_id = str && *str == '@' ? str + 1 : str;
-	const char* type = strstr(str, ".ed25519");
-	return tf_base64_decode(author_id, type - author_id, bin, crypto_box_PUBLICKEYBYTES) != 0;
+	const char* type = str ? strstr(str, ".ed25519") : NULL;
+	return author_id && type ? tf_base64_decode(author_id, type - author_id, bin, crypto_box_PUBLICKEYBYTES) != 0 : false;
 }
 
 static uint64_t _tf_ssb_callback_pre(tf_ssb_t* ssb)
diff --git a/src/ssb.js.c b/src/ssb.js.c
index 990c0889..e4565a8b 100644
--- a/src/ssb.js.c
+++ b/src/ssb.js.c
@@ -1136,8 +1136,8 @@ static JSValue _tf_ssb_hmacsha256_verify(JSContext* context, JSValueConst this_v
 	const char* signature = JS_ToCStringLen(context, &signature_length, argv[2]);
 
 	const char* public_key_start = public_key && *public_key == '@' ? public_key + 1 : public_key;
-	const char* public_key_end = strstr(public_key_start, ".ed25519");
-	if (!public_key_end)
+	const char* public_key_end = public_key_start ? strstr(public_key_start, ".ed25519") : NULL;
+	if (public_key_start && !public_key_end)
 	{
 		public_key_end = public_key_start + strlen(public_key_start);
 	}
diff --git a/src/ssb.tests.c b/src/ssb.tests.c
index b875fa0b..f7047c15 100644
--- a/src/ssb.tests.c
+++ b/src/ssb.tests.c
@@ -332,7 +332,10 @@ static void _broadcasts_changed(tf_ssb_t* ssb, void* user_data)
 	{
 		count = &test->broadcast_count2;
 	}
-	*count = 0;
+	if (count)
+	{
+		*count = 0;
+	}
 	tf_ssb_visit_broadcasts(ssb, _broadcasts_visit, count);
 	tf_printf("BROADCASTS %d %d %d\n", test->broadcast_count0, test->broadcast_count1, test->broadcast_count2);
 }
diff --git a/src/task.c b/src/task.c
index 5fd8d359..63a2268b 100644
--- a/src/task.c
+++ b/src/task.c
@@ -237,8 +237,8 @@ static import_record_t** _tf_task_find_import(tf_task_t* task, taskid_t task_id,
 
 static bool _import_record_release(import_record_t** import)
 {
-	import_record_t* record = *import;
-	if (--record->_useCount == 0)
+	import_record_t* record = import ? *import : NULL;
+	if (record && --record->_useCount == 0)
 	{
 		tf_task_t* task = record->_owner;
 		JSContext* context = task->_context;
@@ -530,9 +530,12 @@ JSValue _task_invokeExport_internal(tf_taskstub_t* from, tf_task_t* to, exportid
 		tf_trace_end(to->_trace);
 
 		JS_FreeValue(to->_context, this_val);
-		for (int i = 0; i < length - 1; i++)
+		if (argument_array)
 		{
-			JS_FreeValue(to->_context, argument_array[i]);
+			for (int i = 0; i < length - 1; i++)
+			{
+				JS_FreeValue(to->_context, argument_array[i]);
+			}
 		}
 		JS_FreeValue(to->_context, arguments);
 	}