Those tools are useful at identifying common coding errors that may result in security issues, but the same tools have proven ineffective at identifying vulnerabilities that enter code through open source components, the report warns.