domains / families / software-engineering / code-audit

code-audit

authentic

Authorized source-code security review and SAST workflows: Semgrep and CodeQL pattern hunting, dangerous API identification, and fix verification.

When to use

• Reviewing a codebase for security defects with static analysis.
• Verifying that a vulnerability fix actually removes the flawed pattern.

When not to use

• Static analysis produces false positives; manual triage is required.
• Coverage depends on language support of the chosen SAST engine.

Skill page

Source