A developer uses a tool that analyzes source code for potential security flaws without executing the program. This is an example of: