Most security errors are the kind that that the tools catches, like unsanitized SQL or unescaped HTML. Those targeted by nation states or running high value targets probably need third party sec audits, but this is a perfectly good addition to a CI or pre commit hook.