Study shows open-source code quality improving

Coverity's scanning service employs static analysis, which is used to check code for security or performance problems without having to run an application itself. This is preferable because "testing every path in a complex program as it runs requires constructing a large number of special test cases or structuring the code in special ways," Coverity said.

"Static analysis [tools] won't tell you that your business process is working correctly ... but they will tell you that the code itself is technically solid, and follows the kind of programming best practices you'd expect to see from code that has gone through a proper code review," said Forrester Research analyst Jeffrey Hammond via e-mail.

The tools tend to be most helpful for finding "structural 'anti-patterns' in code, poor programming practices that can result in performance and security issues like memory leaks and buffer overflows as well as more exotic conditions like errors due to parallel execution of code in a multicore CPU environment," he added.