> "useful when used by a professional" to "half as useful when used by anybody and full of false positives." Where I work we have a desire for both. We want

> "useful when used by a professional" to "half as useful when used by anybody and full of false positives." Where I work we have a desire for both. We want developers to be able to scan their own code -- preferably automatically as part of a CI process -- for things that are clearly wrong, without needing to be appsec experts, and clear out a lot of the low-level brush. We also want complex tools that are used by appsec to be able to do their jobs faster. This is timely since I'm about to do a search for tools for this. I'd love, for example, a way to see the permissions for all lines returned by "rake routes", whether those are resolved by CanCan or where CSRF is disabled or whether it's been overruled by some skip_authorization_check.