Maybe the latest version changes things, but up until this point, this has had a decidedly questionable impact on the security of plugins from what we have seen. While it can help identify some security issues, it also can produce some pretty poor results. It sometimes will flag insecure code as being insecure, but for a reason that isn’t actually an issue. So you can end up with developers making change and thinking their code is now secure, when the code still contains a serious vulnerability.

While misuse of a tool is hard to avoid, it doesn’t seem that it is clearly articulated the significant limitations of it when it comes to its role in reviewing the security of code.