First let me be clear - I've talked with folks at this company and I think they are true believers in their product. That's important and positive.

But it isn't enough.

I opted for the "upgraded" version of this LTD to get access to the "enterprise" features (really the ones you probably want).

I didn't think the 100,000 lines of code limit would be an issue but it's amazing how quickly a project blasts way past that number. So then the costs skyrocket as the total codebase you are examining increases. Just a few projects and you can be well north of the limit by several factors.

Which in and of itself might not be a problem if the system delivers true value.

For me, it didn't.

First the user interface is muddy. There are clearly issues in its rendering engine. So parts of the screens are malformed. From a company that is "inspecting" code I would expect better in their own project.

But beyond that the real issue is that this system is very rigid in its approach. In my case it has done nothing but flag false positives. That's an incredible waste of time. Basically it has its own opinion about what "best practices" look like. Your code may follow different "best practices" that are as good (or better) but the evaluation engine has no apparent option to be "trained" so you are stuck constantly getting called out for "high" security risks that are, in fact, nothing more than a different way of implementing security. It's a real problem.

Worse, once items are tagged as false positive - nothing in the scoring engine "improves". This is an issue because if you want to use their badges and you've "cleared" all the false positives - your score doesn't reflect the cleared status so your badge shows the pre-fix scores. I'm not going to put a badge on my project saying I have security holes when I actually don't.

Another annoyance is that if your codebase changes and something you've previously flagged as a false positive moves from say line 800 to line 1050 - the system sees that as a "new" issue. It isn't. It just moved. But the system doesn't appear to track things very intelligently.

Which is really my problem about this tool...

Yes the "other" reports seem cool at first blush. But really what I care about is a system that accurately helps me enforce good secure coding in a way that is affordable, consistent, and reliable.

For my purposes this tool simply misses the mark.

Why 2 tacos:
* Expensive upsell (even at 50% off) once you get past the 100,000 line limit which is very easy to do across just 2 or 3 projects.
* Way too many false-positives relative to "findings".
* No way to tune the engine and it doesn't seem to learn from false-positives.
* Doesn't adjust score once false-positives are identified making the scoring and the badges they offer useless.
* Messy interface with some broken bits.