Skip to main content

Steer the audit

Provide additional instructions when you start an audit to guide the agents toward what matters most to you, for example "focus on high-severity vulnerabilities that map to a CVE" or "prioritize logic bugs over input validation in this mature library." Steering cannot override scope or safety rules.

Steering is optional. If you leave it blank, the agents apply their default coverage across all vulnerability categories. Use it when you have a specific concern, a compliance requirement, or context about your application that the agents would not infer from the code alone.

It is most effective when it provides context the agents cannot infer: business rules, compliance requirements, or a known threat model. For example, if a particular module handles payment processing, you can steer the agents to spend extra effort there; if you are auditing a library, you can steer them to focus on the public API surface.

Decisions you have already documented​

You do not have to repeat in steering what your repository already says. When your code ships a security policy, a scope or out-of-scope table, a stated non-goal, or a comment explaining why a control is deliberately off, the agents read it and treat the behaviour it covers as intended. They spend no analysis budget re-litigating it, and a finding that falls entirely inside it is dropped rather than reported.

Two limits are worth knowing, because they decide what still gets reported:

  • The decision covers what it says, not the whole category. "Administrators are fully trusted" settles a path an administrator takes. It does not settle a path that lets an ordinary user reach the same place — that is the bug, and you will still hear about it.
  • Accepting a mechanism is not accepting its consequences. "The team token is shared by design" settles the sharing. It says nothing about that token never expiring, being replayable, or being written somewhere readable, so those are still reported.

If a decision is real but nowhere in the repository, put it in steering. Behaviour on its own — an unguarded route, a permissive default, a usage example — is never read as a decision to accept it.