Auditing Code for Vulnerabilities

Finding real bugs in source code is a different job from running a scanner. A scanner matches patterns; an auditor builds a model of what the code is supposed to guarantee and then hunts for the paths where that guarantee breaks. This skill is the methodology for the second job.

When to Use

• Auditing a repository, service, or library for security defects
• Reviewing a diff, branch, or pull request for introduced vulnerabilities
• Hunting for a specific bug class across a large codebase
• Validating whether a scanner finding or a reported vulnerability is real
• Building an audit plan and coverage report for a client engagement

When NOT to Use