I'd only go so far as to agree that vulnerabilities which are bug related maybe _detected_ by static analysis. Preventing vulnerabilities is an entirely larger

I'd only go so far as to agree that vulnerabilities which are bug related maybe _detected_ by static analysis. Preventing vulnerabilities is an entirely larger problem not addressed by static analysis alone. Architectural security flaws are outside of the scope for static analysis. I'm not trying to nitpick semantics but in this case I think it's important to understand that, in this context, prevention and fixes as well as bugs and flaws need to be differentiated.