Urgh, there are lots of box-ticking tools like that in the industry like blackduck, sonarqube, coverity, etc that scan for problems of various kinds. Like you

Urgh, there are lots of box-ticking tools like that in the industry like blackduck, sonarqube, coverity, etc that scan for problems of various kinds. Like you say a lot of what they actually find is theoretical and not useful, often it's like "If a tree falls in a forest and no one is around to hear it, does it make a sound?", yes it's theoretically an issue... but actually that code path is not reachable, the vulnerable part of the library is not used, etc - there is some external information that the tool lacks that makes the results incorrect and not useful. These things are just driven by senior management needing to do "something" about bugs/security, so they buy something that can do scans and produce reports and stuff, but the cure ends up being worse than the disease.