For those of you who have worked with commercial secure code review tools such as:
- Appscan Source Edition (formerly Ounce)
Or perhaps a free or open-source equivalent such as:
- Klocwork Solo
- Armorize demo
- Fotify Teamserver demo (or the Audit Workbench that comes with the book)
- OWASP O2 (Ounce Open)
do you generally prefer the in-DE plugins/addons (e.g. Fortify Secure Coding Plugin for Eclipse), the standalone fat app (e.g. Audit Workbench), a web application (e.g. Armorize, Fortify Teamserver), a complete build server solution, et al? Why?