[rufflez]

Is your own code free of security vulnerabilities?

Will you be able to identify and avoid issues with 3rd party libraries by reading their code, and the code of all the other libraries that they depend on?

Do you know what all vulnerabilities exist in cyberspace?

I mean that a static code analysis tool can take you much further than reading 3rd party code manually... and that is still going to fall short, but that is as good as it gets

[halostatue]

Do you read the source code of the static code analysis tool to make sure that it’s not hiding some obvious backdoors?

[rufflez]

I look at the outcome, and can certainly say that the tools I use find issues than I didn't know existed