Code Assessment

I appreciate the discussions on various coding methodologies, however I've been asked to approach application testing from a penetration point of view.

I'm just beginning my research in to this topic, and wanted to ask within this list early on. 

I am looking to assess the integrity of an application either by scanning the source code for potential problems (like a security lint for example), and secondly, various tools that test the application in runtime.

The majority of applications to be assessed are written in cold fusion, java, c/c++ and some .asp.

Thank you

Paul Bobby
Lockheed Martin Systems Integration