auditing-code-for-vulnerabilities

Auditing Code for Vulnerabilities

Finding real bugs in source code is a different job from running a scanner. A scanner matches patterns; an auditor builds a model of what the code is supposed to guarantee and then hunts for the paths where that guarantee breaks. This skill is the methodology for the second job.

When to Use

• Auditing a repository, service, or library for security defects
• Reviewing a diff, branch, or pull request for introduced vulnerabilities
• Hunting for a specific bug class across a large codebase
• Validating whether a scanner finding or a reported vulnerability is real
• Building an audit plan and coverage report for a client engagement

When NOT to Use

• Black-box testing of a running app — use testing-web-applications or testing-apis
• A PHP codebase specifically — this methodology applies directly; watch for type juggling, unserialize/phar POP chains, and php:// wrappers
• Hunting a planted webshell or backdoor rather than a vulnerability — use hunting-web-backdoors
• Binary-only targets — use analyzing-binaries
• Dependency and build-pipeline risk — use auditing-supply-chain
• Cryptographic construction review — use reviewing-cryptography
• Writing up finished findings — use reporting-security-findings
• Running a multi-agent discovery campaign across a whole target with builder/critic separation and iteration — use orchestrating-vulnerability-research, which dispatches this skill as the per-slice hunter

The Loop

Auditing is four passes, not one. Do not skip to pass 3.

1. Context      → what does this system protect, and from whom?
2. Attack surface → where does untrusted input enter, and what does it reach?
3. Hunt          → trace specific bug classes along those paths
4. Verify        → prove exploitability before you write a word

Pass 1: Build context before reading code

Do not open files at random. Spend the first block of effort answering: