Post #4161789

2026-07-28 10:59 UTC

@drwhax@infosec.exchange do you have any pointers on *how* to run an LLM over the code base? Just tell Claude to "look for vulnerabilities" or is the process more elaborate?

Replies (1)

@drwhax@infosec.exchange 2026-07-28 11:08

@can@haz.pink yes for sure! There's a couple things you can do, one of them is indeed as basic as, this is app XYZ, written in PHP, review the codebase for security problems, then adversarially review your findings before writing them down in findings/ per bug in markdown. Also make a root cause and look for variants of the same class of issues across the code base. What are some good skills to run is from Trail of Bits which are open-source: https://github.com/trailofbits/skills If it's C/C++, LLM's are pretty good at making fuzzers and seeding the dictionary needed to fuzz them effectively. If it's open-source you can apply for some openai codex api grant: https://openai.com/form/codex-open-source-fund/

Open ##4161783