[allyant]

Any decent static code analysers should be able to detect things like this (catch all’s statements, base64 encoding etc), I am surprised none seem to be used for production code.

[derwiki]

Is SCA often set up to run on the fully built end result running on the production machine? I’ve generally seen them as pre-merge-to-source-control.