Many serious security bugs in web applications sit across several files at once. Request data enters through a controller, moves through data objects and service layers, and turns dangerous only when it reaches a sensitive operation such as a database query or a file action. A scanner that reads one file at a time can miss that path entirely.
Nika, an open-source tool from the payments company PhonePe, works on that problem for Java microservices. It performs cross-file taint analysis, tracing attacker-controlled input across application layers to find out whether that input reaches a security-sensitive sink.