Are there tools for developers to use these (e.g. with VC++), or are they all Microsoft internal?
There is also this: https://github.com/mre/awesome-static-analysis
It's part of VC++.
But I do not recommend using SAL for modern code.
Are there tools for developers to use these (e.g. with VC++), or are they all Microsoft internal?