Is this looking just through a known list of exploits for popular packages/libraries, or is it doing something find holes in my application code?

I'd certainly be interested in the later, and even just hearing how you go about that.