I was impressed that when i fed it a generated sample of CFML and said what could be wrong with this from a security standpoint it identified parametisation of queries