hunting-bugs-with-a-code-graph

name	hunting-bugs-with-a-code-graph
description	Hunt security bugs across a whole codebase by reasoning over its structure (call graph and dataflow) instead of grepping for keywords. Use when you have source access to an authorized target (your own code, an OSS project, or an in-scope engagement) and want systematic coverage of a bug taxonomy rather than a single hunch; when the question is "who calls this, what reaches this sink, which peer function is unguarded." Orients on an unfamiliar codebase, enumerates the full bug taxonomy before drilling in, and turns structural leads into decided findings.
license	MIT

Hunting bugs with a code graph

Grep finds strings; it misses the caller behind a rename, an alias, or an import indirection, and it cannot answer "what can flow into this argument." Reasoning over a codebase's structure - its call graph and dataflow - can. This skill is the master loop for a source-level hunt. Two companions go deeper on single moves: adjudicating-taint-paths (lead → decided finding) and auditing-guard-gaps (the unguarded peer of a guarded function).

When to use

• You have source and want coverage, not a one-off keyword search.
• You're cold on an unfamiliar codebase and need to find where input arrives.
• You want to work a bug taxonomy systematically and prove what you ruled out.

Scope check (do this first)

Only run on code you're authorized to analyze: your own, an OSS project you contribute to, a CTF, or an engagement where source review is in scope. If you can't name why you're allowed to read this source, stop.

The loop

1. Index the target. Build a structural index of the source tree. It is a - re-index whenever the code changes in a way that matters, or you will adjudicate against stale structure.