
% How useful were code analysis tools?
The usefulness of the Fortify Static Code Analysis tool turned out to be very limited.
Since we had most verdicts ready before a license was provided we couldn't use
the tool as an initial guide trough the code. This forced us to manually check
the application source which took quite some time. After the tool became available we
didn't get any new insights regarding potential security risks, just more examples
of problems we already detected.

% How could they be improved? (niet echt een antwoord maar we hebben de tool ook niet echt gebruikt?)
In our opinion the tool could have proved very useful in pointing out certain security
flaws in the initial stage of this project since we spent a lot of time scanning the
application code-base. Since Fortify located relatively low-level problems we could
have used these to locate potential hot-spots. 
Saving us from going trough every source file and trying to determine if they are part of the
applications external access points. In order to improve upon the tool we suggest a larger
focus on determining which parts of a application need to be secure and less on pointing
out actual security flaws.

% How did you experience the rates and amounts of false and true positives?
TODO: feedback per groepslid, ik heb geen idee hoe iedereen dit ervaren heeft.

% How might that be improved?
