Post #4161783
2026-07-28 11:08 UTC
@can@haz.pink yes for sure!
There's a couple things you can do, one of them is indeed as basic as, this is app XYZ, written in PHP, review the codebase for security problems, then adversarially review your findings before writing them down in findings/ per bug in markdown. Also make a root cause and look for variants of the same class of issues across the code base.
What are some good skills to run is from Trail of Bits which are open-source: https://github.com/trailofbits/skills
If it's C/C++, LLM's are pretty good at making fuzzers and seeding the dictionary needed to fuzz them effectively.
If it's open-source you can apply for some openai codex api grant: https://openai.com/form/codex-open-source-fund/
Replies (3)
-
@Offbeatmammal@mastodon.social 2026-07-28 11:35
@drwhax@infosec.exchange @can@haz.pink great pointer, thanks. Going to try this tomorrow on a couple of our codebases (one 100% human coded, one originally human but with progressive LMM development over the last couple of months) - might be adjusting some development schedules depending on what I find!
-
@can@haz.pink 2026-07-28 11:13
@drwhax@infosec.exchange thanks!
-
@bosconet@ioc.exchange 2026-07-31 17:08
@drwhax@infosec.exchange @can@haz.pink if you have a web app....ask it to assess the code against owasp 2025, document all finding and write validation code to prove any findings And then come back and re-eval the code for any findings that can be chained together