I second this. I manage a couple of teams and one is dealing with legacy a PHP stack where they've been refactoring things like SQL injection risks and whatnot. Having something as an automated second set of eyes would be brilliant.
Not really at the moment. I've been slowly refactoring it into a publishable chunk of code but progress is slow. I will publish it on github when it is done.
I am not sure that is enough, I mean if you look at the supposed results many of them can't actually be actacked (like the on that tests that Id is a number before it is used) but a semi stupid script wouldn't catch those.
We've got 30 odd rules so far that have saved us from all sorts of pain from exception swallowing to adding test ignores as well.