[bawolff]

Oh i agree 100% with that. Off the shelf static analysis tools have massive noise and rarely come up with useful vulns.

Most of the time they end up making a 20 page report with 500 issues that nobody reads because 499 of the issues are stupid.

(However, they can work if highly tuned to specific environment and workflow)