A development team building a cloud-native web application wants to detect vulnerabilities as early as possible in their secure SDLC. They already run software composition analysis on third-party libraries during the build. The security architect now wants a tool that analyzes the team's own source code for flaws like SQL injection patterns before the application is ever compiled or deployed to a running environment. Which testing approach best meets this requirement?