Evaluation of Static Analysis Tools for Finding Vulnerabilities in Java and C/C++ Source Code

It is quite common for security testing to be delayed until after the has been developed, but vulnerabilities may get noticed throughout the phase and the earlier they are discovered, the easier and it will be to fix them. Software development processes such as the software development lifecycle incorporates security at every stage of design and development process. Static code scanning tools find in code by highlighting potential security flaws and offer on how to resolve them, and some may even modify the code to remove susceptibility. This paper compares static analysis tools for Java and/C++ source code, and explores their pros and cons.