Source Code Audit
A source code audit is AISafe's white-box security assessment. AI agents with static analysis read your source code, follow data flows across files and functions, and find vulnerabilities that traditional tools miss — including logic bugs that only make sense when you understand how parts of the system interact.
You point the audit at a repository (or an uploaded archive). The agents build a structural model of the codebase, trace user input from where it enters to where it reaches a sensitive operation, and produce evidence-backed findings: exact code locations, taint flows, and a proof-of-concept description. A separate triage pass confirms what is real, deduplicates by root cause, and assigns a confidence score.
The audit runs unattended. You start it, the agents do the work, and you review the results when they are ready.
In this section
- Prepare your repository — how to give AISafe your source
- How it works — the multi-agent pipeline from Understanding to Report
- Run an audit — start one from the dashboard
- Findings — what it detects and the evidence you get
- Steer the audit — focus the agents on what matters
- Attack Paths — view evidence as kill chains
- SBOM export — machine-readable component inventory
- FAQ — common questions
When to use it
Choose a source code audit when you want a deep, source-level review of a repository without exposing a live target. It suits codebases you ship, libraries, and code that is not yet deployed.
It is not a runtime test. A source code audit reads code; it does not probe a running application. To validate a live target over HTTP, use a Black-Box Pentest or pair source access with live validation in a White-Box Pentest.
The audit is static and source-level. It does not access a live runtime. The optional SBOM export is a machine-readable inventory, not a runtime attestation of everything loaded in production.