Vulnerability pattern scanning

Planned feature

Pattern scanning is not released. No rule set, vulnerability coverage, or accuracy metric is claimed.

The planned extension flags candidate patterns for an analyst to inspect. A pattern match is a lead, not proof of exploitability. The absence of matches is not proof that a program is secure.

Review a candidate

The eventual workflow must connect a finding to a function, address, matched evidence, and rule version. Review callers, input constraints, allocation sizes, and error paths. Record whether the candidate is confirmed, rejected, or still uncertain, with reasoning rather than a label alone.

Release checklist

• VERIFY rule sources and licenses, supported architectures, and analysis prerequisites.
• VERIFY what the scanner observes and which paths or constructs it cannot evaluate.
• VERIFY severity definitions and how findings are deduplicated.
• VERIFY cancellation, timeouts, export format, and reproducibility.
• VERIFY whether model assistance is involved and what data leaves the machine.

Use only samples you are authorized to analyze. Keep the scanner version and settings with a report so another analyst can reproduce the observation.

Read Auto analysis before scanning and Triage reports for the separate planned reporting workflow.