App Security

Verify suspected security bugs as true or false positives with documented evidence

Compare code graphs at two commits to surface new attack paths and privilege changes

Fix a confirmed local bug at the invariant level with variant search and tests

Translate Mermaid crypto protocol diagrams into ProVerif models for formal checks

Write a patch commit and proof report for a known bug in a local codebase

Validate security patches with baseline vs patched evidence and regression checks

Independently prove a local security patch with scoped and three-arm evidence

Review Rust code for unsafe blocks, FFI, concurrency and panic-driven DoS risks

Parse, filter and deduplicate SARIF scanner output for CI and reporting

Walk through a secure smart contract workflow with Slither scans and manual review

Run approved Semgrep rulesets over a codebase and merge the output to SARIF

Write custom Semgrep rules to detect security bugs and unsafe code patterns

Port existing Semgrep rules to other languages with matching test suites

Spot footgun APIs and dangerous defaults that invite security mistakes

Scan Solana and Anchor programs for arbitrary CPI, PDA and signer check bugs

Scan Substrate and FRAME pallets for overflow, weight and origin check bugs

Audit dependencies for advisories, abandoned packages and install-time scripts

Scan TON FunC contracts for fake Jetton, gas and boolean misuse bugs

Build multi-language code graphs for blast radius, taint and privilege analysis

Decide whether one finding is real using code graph reachability and taint paths

Gate branch and PR diffs on new entrypoints, tainted paths and removed auth checks

Run full structural analysis of a codebase for hotspots, taint and attack surface

Get a quick structural overview of a codebase with languages and entry points

Expand one vulnerability into graph neighbors that may share the same bug

Hunt for other instances of a bug found in one file across the codebase

Triage vulnerability reports and CVEs to decide validity, priority and response

Check crypto implementations against Project Wycheproof vectors for known attacks

Find missing zeroization of keys and secrets, including ones compilers optimize away

Run a STRIDE threat model review of a change and report exploit paths by severity

Adapt a sanitizer-based vulnerability pipeline to new bug classes and languages

Generate and verify candidate patches for confirmed security findings

Get oriented with the vulnerability harness and answer questions from its docs

Build a threat model from owner interviews or past vulnerabilities and code

Verify, dedupe and rank raw scanner findings by real exploitability

Scan source code for vulnerabilities with parallel review subagents

Pick and implement the right Twilio auth method, from API keys to OAuth tokens

Harden Twilio apps with signed webhooks, key management and SMS pumping defenses

Detect compromised dependencies and malicious plugins in agent supply chains

Scan AI infrastructure, agent tools and skills for security issues via AI-Infra-Guard

Scan an agent skill for security risks locally before installing it

Audit installed skills and check an OpenClaw setup for data leak risks

Find path traversal and unsafe file handling in upload, save and extract flows

Find hardcoded secrets in source code, configs and infrastructure as code

Map security findings to the OWASP Top 10 for Agentic Applications 2026

Review Python, JavaScript and Go code for security best practices and fixes

Harden Django apps against XSS, CSRF, SQL injection and insecure deployment settings

Audit a Rails app for XSS, CSRF, SQL injection, IDOR and exposed secrets

Find smart contract access control gaps like missing modifiers and bad msg.sender checks

Navigate vulnerability research playbooks and chain-building skill catalogs