Static analysis isn't going to beat humans, also: https://hackerone.com/