Static source code analysis for bug finding ("static analysis"
for short) is the process of detecting bugs via an automated
tool that analyzes source code without executing it. The idea
goes back at least to Lint, which was invented at Bell Labs in
the 1970s, but static analysis has undergone a revolution in
effectiveness and usability in the last decade. The initial
focus of static analysis tools was on the C and C++ programming
languages. Such tools are particularly necessary given C/C++'s
notorious flexibility and susceptibility to low-level bugs. More
recently, tools have flourished for Java and/or Web
applications; these are needed because of the prevalence of
easily exploitable network vulnerabilities. When using such
tools, it is all too easy to deploy them in a way that looks
good superficially, but misses important defects, shows many
false positives, and brings the tool into disrepute. This
article is a guide to the process of deploying a static analysis
tool in a large organization while avoiding t