The good, the bad, and the ugly: three ways to use a semantic code query system

D-CUBED is a semantic code query system for Java. Its focus is on capturing the semantics of an analyzed program. It provides rich support to investigate the call flow and data flow of a program by using static analysis techniques with the custom model of symbolic instances. The usage scenarios of D-CUBED include: (1) detection of design patterns with the focus on code semantics (the good), (2) discovery of bugs, including a range of security holes (the bad), (3) assessment and improvement of a design by discovering bad design and code practices (the ugly).