Variant Analysis

Find the other instances of a bug you have already found. One root cause usually has several manifestations, and they are rarely in the module where you found the first one.

When to Use

• A vulnerability has been found and you need to search for similar instances
• Building or refining CodeQL/Semgrep queries for security patterns
• Performing systematic code audits after an initial issue discovery
• Analyzing how a single root cause manifests in different code paths

When NOT to Use

• Initial vulnerability discovery — use audit-context-building or a domain-specific audit
• General code review with no known pattern to search for
• Writing fix recommendations — use issue-writer
• Understanding unfamiliar code — use audit-context-building first