A development team is preparing a web application for release. Security wants to identify insecure coding patterns such as improper input validation and use of deprecated cryptographic functions across the entire codebase, including code paths that may rarely execute at runtime. The team has full access to the source code and wants the earliest possible feedback in the development pipeline. Which testing approach best meets these requirements?