I am setting up a software security initiative at a small software company. Part of this is selecting a static analysis tool for early and automated detection of security vulnerabilities.
Please keep in mind:
- This static analysis tool is not a replacement for manual or penetration testing. This will come later but static analysis tools allow discovery of issues as soon as the code is written rather than near the end when the product is complete. While I am working with good developers, they are not security experts. The code base is increasingly large (100K+ lines) and I personally cannot review each and every change.
- Many static analysis tools allow the creation of new rules and I am happy to so do. However, my focus is on delivering software instead of creating and debugging basic security checks.