One class of tools that can help with making your code more secure is the so-called Static Application Security Testing (SAST) tools. They are a variant of static analysis tools only focused on security aspects.
SAST tools integrate well into CI/CD pipelines as they are simply reading your source code. The output is usually suitable for CI/CD as well since it highlights problems found in particular places in the source code. On the other hand, static analysis may omit many types of problems that cannot be found automatically or cannot be found solely with static analysis. These tools are also oblivious to issues related to configuration, as configuration files aren't represented in the source code itself.
Examples of C++ SAST tools include the following open source solutions:
- Cppcheck (http://cppcheck.sourceforge.net/), which is a general-purpose static analysis tool focused on the low number of false positives
- Flawfinder (https://dwheeler.com/flawfinder/), which...
