References

https://clang-analyzer.llvm.org/checker_dev_manual.html - though this talks about integration into clang itself, not a loadable module like we can with clang-tidy

data flow

Code doing data flow analysis of clang _Nullable/Nonnullable attribute.

C++now talk discussing it (doesn't describe the code but instead the specs/use of the code):

The clang dataflow analysis code, haven't found any documentation beyond doxygen

doxygen for this:

Discusses the process, but not the API, has links to other references.