Thank you. This tool is on the heavy side, with its seemingly own query language.

I was rather thinking of a specialized scanner (say only for C sources) that just looks for definite classes of vulns, not necessarily scriptable.