Static code analysis is performed during the design and build phase because it examines source code without executing it, identifying vulnerabilities early in development. Dynamic analysis (A) requires running the application and typically happens later during testing phases.