It seems that Coverity[0] is offering free static analysis to open source projects. Even if it is a marketing move, it will benefit the open source ecosystem in the long run. You'll waste some time analyzing false positive defects, the handful of critical/security error found make it worth it in my opinion. Notably the duplicate "goto fail" in one of the recent apple vulnerability should have triggered the dead code detection.