A team wants automated detection of supported security weaknesses in source code before release. Which check should be added?

1. A longer release note
2. Only a count of source files
3. Code security scanning with appropriate analysis rules
4. Only a successful package upload