Detecting Android malware by extracting a static call graph and applying ML https://blog.acolyer.org/2017/03/09/mamadroid-detecting-android-malware-by-building-markov-chains-of-behavorial-models/ (impressive how high-level the CFG is)
miniblog.
Related Posts
Many languages use docstrings rather than doc comments: it certainly makes extracting them easier. You just parse the code.
Could you go further and require all comments to be string literals? I'm struggling to think of many downsides.
There's an eslint plugin for extracting JS from HTML, so you can catch issues even when using inline JS!
Extracting machine-readable specs from natural language specs for ARM architectures, and finding ambiguities!