1) reading code, spotting standard bugs, or with domain know-how spotting logic errors. 2) static code analyzers (i.e. llvm scan-build). Lots of false positive

1) reading code, spotting standard bugs, or with domain know-how spotting logic errors. 2) static code analyzers (i.e. llvm scan-build). Lots of false positives, still requires 1). 3) fuzzing (i.e. afl). Usually some setup needed, still requires 1).