A development team's CI/CD pipeline currently only runs unit tests before deployment. The security lead wants to add automated security testing that inspects the application's source code for insecure coding patterns (such as SQL injection sinks and hardcoded credentials) as early as possible, without requiring the application to be running. Which testing approach should be recommended for this specific need?