SemmleCode Professional comes with a wide range of pre-packaged analyses, from architectural properties and metrics, to statement-level checks for likely bugs and violations of best practice.

•  Architecture
  •  General Class-Level Information
    •  Comment ratio per type in each package
    •  Classes with complex control flow
    •  Hub types
    •  Inheritance depth distribution
    •  Lack of cohesion
    •  Wide class hierarchies
  •  General Package-Level Information
    •  Cyclic packages
    •  Distance from main line
    •  Hub packages
    •  Comment ratio per package in each project
  •  General Top-Level Information
    •  Ant target dependencies
    •  General statistics
    •  Maven Pom Dependencies
  •  Layering
    •  SQL accesses
    •  UI accesses
  •  Refactoring Opportunities
    •  Methods or constructors with too many parameters
    •  Class passively stores data
    •  Large Types
    •  Classes sharing similar methods
    •  Classes with too many instance fields
•  Author Information
  •  Documentation of types per author
  •  Prolific authors
•  Likely Bugs
  •  Arithmetic
    •  Bad check for oddness
    •  Result of integer multiplication cast to long
    •  Random used only once
  •  Cloning
    •  Missing super Clone
  •  Collections
    •  ContainsTypeMismatch
  •  Comparison
    •  Sign check of bitwise operation
    •  Covariant equals
    •  Equals on arrays
    •  Missing definition of equals
    •  Hashed value without hashCode definition
    •  Equals on incomparable types
    •  Inconsistent compareTo
    •  Inconsistent equals and hashCode
    •  Equals method does not inspect argument type
    •  Equality test on floating point values
    •  Suspicious reference equality test of boxed types
    •  Reference equality test on Strings
  •  Concurrency
    •  Wait on Condition
    •  Thread-unsafe use of DateFormat
    •  Empty Run in Thread
    •  Futile synchronization on field
    •  Incorrect lazy initialization of a static field
    •  Sleep with lock held
    •  Start of thread in constructor
    •  Wait with two locks held
  •  Frameworks
    •  JUnit
      •  BadSuiteMethod
      •  TestCase implements tearDown but doesn't call super.tearDown()
      •  Test case has no tests
    •  Swing
      •  ThreadSafety
  •  I18N
    •  Bad internationalization
  •  Likely Typos
    •  Typo in constructor
    •  Dangerous non-short-circuit logic
    •  Typo in equals
    •  Typo in hashCode
    •  Typo in toString
  •  Security
    •  HTTP response splitting vulnerability
    •  Cross site scripting vulnerability
  •  Serialization
    •  Incorrect serialVersionUID Field
    •  Externalizable but no public no-argument constructor
    •  Serializable but no void constructor
    •  Non-serializable Comparator
    •  Non-serializable Field
    •  Serializable inner class of non-serializable class
    •  ReadResolve must have Object return type, not void
  •  Statements
    •  Empty branch of conditional, or empty loop body
    •  Impossible Array Cast
•  Metrics
  •  Types
    •  RefTypes with high response
    •  RefTypes with high specialization index
•  Performance
  •  String concatenation in loop
  •  Inefficient use of key set iterator
  •  Inefficient String constructor
•  Violations of Best Practice
  •  Dead Code
    •  Unused classes and interfaces
    •  Empty body of finalizer
    •  Field is never assigned a non-null value
    •  Unused field
  •  Exception Handling
    •  Ignores exceptional return value
  •  Implementation Hiding
    •  Cast from abstract to concrete collection
    •  Unsafe use of getResource
  •  Naming Conventions
    •  Confusing method names because of overriding
    •  Static final fields that are assigned a literal should be named in UPPERCASE
    •  Field masks field in super class
    •  Local variable shadows field
    •  Class has same name as super class
  •  Undesirable Calls
    •  Array in String append
    •  Dangerous runFinalizersOnExit
    •  Useless toString on String
    •  Call to System exit
    •  Print an array