Skip to main content

Findings

A source code audit excels at detecting:

  • Injection vulnerabilities — SQL injection, command injection, SSRF, LDAP injection, path traversal. The agents trace user-controlled input from where it enters the application to where it reaches a query, command, or request.
  • Authentication and authorization flaws — broken access control, privilege escalation, missing auth checks. The agents identify where the application should enforce checks and where those checks are absent or bypassable.
  • Secrets and credentials — hardcoded API keys, tokens, and passwords. The agents scan for patterns that look like credentials and confirm whether they are real.
  • Cryptographic weaknesses — weak algorithms, insecure random number generation, improper key management. The agents flag deprecated or insecure crypto primitives.
  • Deserialization and serialization issues — unsafe deserialization, XML external entity (XXE). The agents trace data flows into deserialization sinks and check whether the input is trusted.
  • Logic bugs — race conditions, business logic flaws, state manipulation. The agents reason about intended behavior and look for ways to subvert it.
  • Vulnerable dependencies — exact-version OSV advisories anchored to the manifest or lockfile, with a suggested upgrade path.

Evidence​

Each confirmed finding provides:

  • Vulnerable locations — the exact file, function, and line range, so you can jump straight to the code.
  • Taint flow — the full path from source to sink, including any missing or insufficient sanitization. This shows how the vulnerability is reachable.
  • Proof-of-concept — a description of how an attacker could exploit the vulnerability, grounded in the actual code.
  • Suggested fix — a concrete remediation recommendation, with a code snippet showing the corrected pattern where useful.

The agents map each finding to a standard category (CWE or OWASP) where applicable, so you can cross-reference with your existing security tracking and compliance frameworks.

What the audit did not find​

A finding list tells you what the audit found. It cannot, on its own, tell you what the audit looked for. The audit answers that separately: it walks a methodology checklist and records, for every check, whether it tested the check against your code, whether other work in the run already answered it, whether your application has no such surface, or whether the check needs a running system. Read that record next to this list. See Coverage.

Severity and triage​

Each finding carries a severity level from critical to info. The triage pass confirms or rejects findings, deduplicates by root cause, and assigns a confidence score. See Severity levels and What triage does.

Finding statuses (open, confirmed, false positive, accepted risk, duplicate, fixed) drive your remediation workflow. See Concepts: Finding.

note

The triage recommendation is a starting point. Your team decides the final status for each finding.