Explain how you would use static code analysis tools in a CI/CD pipeline to enhance security in software development. Include specific tools, their application, and potential limitations.

Static code analysis tools, such as SonarQube and Checkmarx, can be integrated into the CI/CD pipeline to automatically scan code at various stages of development. These tools help identify vulnerabilities, code smells, and coding standard violations before code is merged into production. For instance, implementing SonarQube can provide real-time feedback during the coding phase, enabling developers to rectify issues immediately. However, limitations may include false positives, the necessity for developer training to interpret results correctly, and the inability to analyze runtime vulnerabilities. To maximize effectiveness, combine these tools with dynamic analysis during testing.