For more about actually implementing static analysis security tools, see my talk Making Your Life Easier with Static Analysis for Dynamic Languages.
For more about what prompted our automation at Twitter (and SADB), see my talk Rise of the Machines: Security Automation at Twitter.
Just a short list of some open source tools, there are more out there.
Justin Collins