Checkmarx parse raw source code (no need to compile) stores it in a DB and queries it with hundreds of rules to find vulnerabilities. Rules can be easily modified & added.