They hide in the code that is not being executed by your unit tests. The code that is not under test is just an incubator for them to multiply and fester. Along with code reviews, and static code analysis tools, tools like Emma and Clover, should be a part of your build and development process.
For Maven users, it is as easy as adding emma:emma as one of the goals.
For Buildr users add : require “buildr/emma” to your Rake file, and targets of emma:xml emma:html to your build command line.
Hudson has a really nice Emma plugin that makes these results visible. The stats do not tell the whole story but they tend to reveal a lot about the test coverage of your current test suite.