tl;dr - rolling up your sleeves and getting into the technical weeds of someone else's code can take a lot of effort, but it is the most effective way to identify unknown vulnerabilities in it.