@kornel Nah, flawfinder for example is nicely exhaustive (CWE-wise), but lacks the ability to check context/branches like LLVM/Clang's analyzer (which is comparatively incomplete) does, which makes flawfinder too prone to what would be a false positive in other software.