Skip to main content

Findings

A source code audit excels at detecting:

  • Injection vulnerabilities — SQL injection, command injection, SSRF, LDAP injection, path traversal. The agents trace user-controlled input from where it enters the application to where it reaches a query, command, or request.
  • Authentication and authorization flaws — broken access control, privilege escalation, missing auth checks. The agents identify where the application should enforce checks and where those checks are absent or bypassable.
  • Secrets and credentials — hardcoded API keys, tokens, and passwords. The agents scan for patterns that look like credentials and confirm whether they are real.
  • Cryptographic weaknesses — weak algorithms, insecure random number generation, improper key management. The agents flag deprecated or insecure crypto primitives.
  • Deserialization and serialization issues — unsafe deserialization, XML external entity (XXE). The agents trace data flows into deserialization sinks and check whether the input is trusted.
  • Logic bugs — race conditions, business logic flaws, state manipulation. The agents reason about intended behavior and look for ways to subvert it.
  • Vulnerable dependencies — exact-version OSV advisories anchored to the manifest or lockfile, with a suggested upgrade path.

Evidence​

Each confirmed finding provides:

  • Vulnerable locations — the exact file, function, and line range, so you can jump straight to the code.
  • Taint flow — the full path from source to sink, including any missing or insufficient sanitization. This shows how the vulnerability is reachable.
  • Proof-of-concept — a description of how an attacker could exploit the vulnerability, grounded in the actual code.
  • Suggested fix — a concrete remediation recommendation, with a code snippet showing the corrected pattern where useful.

The agents map each finding to a standard category (CWE or OWASP) where applicable, so you can cross-reference with your existing security tracking and compliance frameworks.

Severity and triage​

Each finding carries a severity level from critical to info. The triage pass confirms or rejects findings, deduplicates by root cause, and assigns a confidence score. See Severity levels and What triage does.

Finding statuses (open, confirmed, false positive, accepted risk, duplicate, fixed) drive your remediation workflow. See Concepts: Finding.

note

The triage recommendation is a starting point. Your team decides the final status for each finding.