LGTM provides an online service to analyze source code of all major languages for security bugs and errors.
I am looking for a similar solution, which performs the tests while the source code stays in the company.
The solution I am looking for
- may cost money and
- may be a closed source tool
- must run on at least one of the OS: Microsoft Windows, or Linux
- should support at least C, C++ ideally also ASM.
- should report insecure libraries, if a CVE is public
- should report insecure style and patterns
- should report bugs, which can be found by simple static analysis