It seems that some (perhaps crazy) teams are looking to scan their code before or even without compiling it, but for certain languages, the scanner requires access to the binary files.
Have anyone encountered this issue before?
Can anyone shed light on why this requirement exists? Is there any way to bypass this constraint ?
The reason varies by language. For Java, it’s that analysis uses both .class and .java files to get a full understanding of the code. For C# it’s that the rules are run during the compile. For C, C++ and Objective-C it’s something in the middle: information needed to fully understand the code is gathered during compile.