The objective of a source code keyword or a specific patterns-based search technique is not to replace any other automated code-scanning tools. It's to support both the whitebox review and automated code-scanning tools by searching potentially high-risk strings. The security team may prepare or define a set of keywords or regular expression strings that can lead to security issues. Once the project team has a set of search strings, it may use any search tool, such as GREP, to do the search, and analyze the search results. This kind of search can be done with partial source code, and is programming-language independent. It's simple to search for a specific issue, as long as we have well-defined search strings.
The following diagram shows a general process of this kind of whitebox review technique:
Here is an example of how to search...
