Professional Tool for Professional Results
What do you like best?
For me, Xanitizer is my must-have to do source code analysis for Java applications. The taint analysis, based on a data flow analysis. Besides of the classic static source code analysis, which is pattern based, Xanitizer analyses the source code from the user's entry points as the source all the ways through to the sinks. The findings are extraordinary good, much better than in the other tools we evaluated.
I like also the integration of the OWASP Dependency Check and FindBugs, which brings up even more security relevant findings.
What do you dislike?
It is limited to Java. Up until now to backend Java, but I know that they also work on JS analysis.
But to be good as a tool, it is better to focus on one field and do well with it, instead of working on all languages and having poor results.
What problems are you solving with the product? What benefits have you realized?
We do source code analysis with Xanitizer as a service for our internal and external customers, focusing on software security. This can't be done by reading all the code, but you rather have to divide and conquer using clever tools.
