You need a complete codebase since it uses AST to trace the data flow and code that...

You need a complete codebase since it uses AST to trace the data flow and code that appears later might make previous code suddenly insecure