Skip to main content

How it works

A source code audit runs a multi-agent workflow through several stages. Specialized agents carry out each stage and collaborate on the code graph. Each stage builds on the previous one, and the agents share context, so the audit benefits from the analysis stage's understanding of your codebase.

The pipeline​

  1. Understanding — the agents acquire your source and build a structural model of the codebase: entry points, frameworks, data flows, and trust boundaries. This model enables taint analysis, call graph traversal, and cross-file data flow tracking.
  2. Analysis — the agents follow data flows from source to sink, noting where user input enters the system, where the system sanitizes it (or fails to), and where it reaches a sensitive operation. They map authentication checks, authorization boundaries, and configuration, and form hypotheses about where vulnerabilities might live.
  3. Audit — for each candidate vulnerability, an agent traces the full path from source to sink, checks for sanitization or validation that would block exploitation, and produces evidence: the vulnerable code locations, the taint flow, and a proof-of-concept description. The agent iterates on hypotheses, discarding dead ends and confirming real issues. This stage produces most findings.
  4. Triage — a separate triage agent re-examines each finding's evidence, confirms or rejects it, deduplicates findings that share a root cause, and assigns a confidence score. This pass keeps the false-positive rate low and the backlog clean.
  5. Report — the final stage compiles confirmed findings, evidence, and remediation guidance into a shareable PDF.

The entire workflow runs without human intervention. You start the audit, the agents do the work, and you review the results when they are ready.

Duration​

The audit's duration depends on the size and complexity of your codebase. Larger repositories with more files and deeper call graphs take longer. You can monitor progress from the assessment detail page while it runs.

The agents reason about your code's behavior, follow data flows across files and functions, and test whether a hypothetical vulnerability is reachable. They find issues that traditional static analysis tools miss, including logic bugs and vulnerabilities that require understanding how multiple components interact.