@ConorMancone Man I hope all the best
So as a pentester, I sometimes (rarely) get source code for some applications, and it's routine for me to throw them into some kind of Source Code Analysis Tool.
These tools generate lots of output, and the vast majority of the output is complete garbage
For example: "CRITICAL - Improper Cryptography - Use of Base64"
Yes, the tool actually considers "base64" as "cryptography". It rightfully assesses it should not be used as substitution for encryption, but it apparently never occured to the developers of the tool that sometimes binary data needs to be represented as text, hence base64.
A lot of other warnings are "what if's", like "you didn't check if this parameter is null", even though the only function that calls it always checks if the parameter is null before calling that function.
Sure you could say "But what if you extend your code?", and that's a valid point, but completely irrelevant for me in a pentest
So as a pentester, the output of those tools are very often completely irrelevant
But as a developer, they might be useful if and only if you properly maintain a list of exceptions and explanations as to why these are exceptions
Because otherwise a company will throw 150.000 USD at a SCAT, project managers will get 15.000.000 warnings, decide that's too many, fiddle with the parameters until it's more like 15 warnings, and then the developers will explain why all of those are false positives.