From comparison to SonarQube "Current limitations: No data-flow or taint analysis yet. Rules are syntactic or use the semantic layer, so they're fast and predictable but miss bugs that need values traced across functions."

[dead]