I don't agree. I work with static analysis daily and idiomatic code is the easiest to analyze. If coverity isn't catching the bugs and they are undefined behav

I don't agree. I work with static analysis daily and idiomatic code is the easiest to analyze. If coverity isn't catching the bugs and they are undefined behavior bugs then coverity needs to be more aggressive. But it probably doesn't support things like ownership annotations, and it probably gives up strict checking in order to avoid false positives. The problem is developers. Developers are lazy. Most developers won't even turn on compiler warnings, never mind using the sanitizers. So tool makers create sub-par tools to cater to them. Fewer false warnings means more customers, even if it also means fewer security holes. It's why we use an in house tool and crank up the checks to 11.