A payments startup measures defects per thousand lines of code across its repositories to monitor code quality. Which category of software assessment does that metric represent?

Vulnerability scanning typically refers to scanning deployed applications or networks for known vulnerabilities, not primarily measuring code defects per line in source code.

Code review is a manual process where developers inspect each other's code, which can find defects but doesn't automatically generate "defects per thousand lines of code" as a direct, automated metric.

Threat modeling is a structured approach to identify potential threats, vulnerabilities, and counter-measures for a system, not a method for directly quantifying code defects per line.

Static code analysis (SCA) is a method of examining source code, bytecode, or binary code without executing the program, primarily to detect defects, security vulnerabilities, and adherence to coding standards. Tools for SCA can quantify metrics like defects per thousand lines of code (DLOC or KLOC) by systematically scanning the codebase for patterns indicating potential issues.