find-security-vulnerabilities-in-code

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Find security vulnerabilities in code

在代码中查找安全漏洞

White-box security review with Strix: the agents read the source to build a model of routes, sinks, and authorization checks, then attempt real exploitation. Findings come with a proof-of-concept, so the output is a short list of proven issues rather than the hundreds of "potential" hits a pattern-matching scanner produces.

Install, LLM setup, all flags, and the managed-cloud path are in the penetration-testing-with-strix skill.

借助Strix进行白盒安全审查：Agent会读取源代码，构建路由、数据接收点和授权检查模型，然后尝试实际利用漏洞。检测结果附带概念验证，因此输出的是少量已证实的问题，而非模式匹配扫描器产生的数百条“潜在”警报。

安装、LLM配置、所有参数以及托管云路径相关内容，请查看penetration-testing-with-strix技能。

Run it

运行工具

bash

undefined

bash

undefined

Local working tree

本地工作目录

strix -n -t ./ --scan-mode standard --max-budget 15

A GitHub repo directly

直接扫描GitHub仓库

strix -n -t https://github.com/org/app --max-budget 15

Monorepo: point at the service that matters, not the whole tree

单体仓库：指向目标服务，而非整个目录

strix -n -t ./services/checkout --max-budget 20

Only what a branch changed (whole-repo review is wasteful on a large repo)

仅扫描分支变更内容（大型仓库中扫描整个仓库会造成资源浪费）

strix -n -t ./ --scope-mode diff --diff-base origin/main --max-budget 10


A local path is mounted into the sandbox **writable**, so the agents can modify it. Run against a clean checkout.

Two things sharply improve results:

1. **Add a running instance of the app.** `-t ./ -t http://host.docker.internal:3000` lets the agents confirm exploitability against live behavior instead of reasoning about it statically — this is the difference between "this looks unsafe" and a validated finding. If nothing is running, static-only findings should be described as unconfirmed.
2. **Scope the review.** Point at the risky subtree and say what matters:
   ```bash
   strix -n -t ./services/api --max-budget 15 \
     --instruction "Focus on the authorization layer in src/auth and every route under src/routes/admin. Multi-tenant app: tenant id comes from the JWT. Flag any query that filters by object id without also filtering by tenant."

Tenancy model, trust boundaries, and which inputs are attacker-controlled are things the agents cannot infer reliably — tell them.

strix -n -t ./ --scope-mode diff --diff-base origin/main --max-budget 10


本地路径会被挂载到沙箱中并设置为**可写**，因此Agent可以对其进行修改。请基于干净的代码副本运行扫描。

以下两点可显著提升检测效果：

1. **添加运行中的应用实例。** 使用`-t ./ -t http://host.docker.internal:3000`可让Agent针对实时行为确认漏洞可利用性，而非仅通过静态分析推断——这是“看起来不安全”与已验证漏洞之间的区别。如果没有运行中的应用实例，静态分析得出的结果应标注为未确认。
2. **限定审查范围。** 指向高风险子目录并明确关注重点：
   ```bash
   strix -n -t ./services/api --max-budget 15 \
     --instruction "Focus on the authorization layer in src/auth and every route under src/routes/admin. Multi-tenant app: tenant id comes from the JWT. Flag any query that filters by object id without also filtering by tenant."

租户模型、信任边界以及哪些输入受攻击者控制，这些内容Agent无法可靠推断——请明确告知。

Reviewing a pull request instead of the whole repo

审查拉取请求而非整个仓库

For diff-scoped review of a branch or PR (and blocking merges on findings), use ci-security-scanning-with-strix — it covers diff scoping, PR comments, and SARIF upload to GitHub code scanning. The managed platform can also review PRs directly via API (managed-pentesting-with-strix).

如需针对分支或PR进行差异范围审查（并在发现漏洞时阻止合并），请使用ci-security-scanning-with-strix技能——它涵盖差异范围限定、PR评论以及向GitHub代码扫描上传SARIF文件。托管平台也可通过API直接审查PR（managed-pentesting-with-strix）。

Read the results

查看结果

strix_runs/<run>/

penetration_test_report.md

(start here),

vulnerabilities/*.md

(one per finding, with PoC and remediation),

vulnerabilities.json

.csv

findings.sarif

(upload to code scanning),

run.json

Before reporting to the user, open each finding and check the PoC actually demonstrates impact. Report file and line alongside the exploit so the fix is obvious.

Exit

means nothing exploitable was proven in what was analyzed — not that the codebase is clean. Check

run.json

status and cost against

--max-budget

, and note which paths went unreviewed if the run was capped.

结果存储在

strix_runs/<run>/

目录下：

penetration_test_report.md

（首先查看此文件）、

vulnerabilities/*.md

（每个漏洞对应一个文件，包含概念验证和修复建议）、

vulnerabilities.json

.csv

、

findings.sarif

（可上传至代码扫描工具）、

run.json

。

向用户报告结果前，请打开每个漏洞记录并确认概念验证确实能展示影响。报告时需附上文件路径、行号以及利用方式，以便明确修复方向。

退出码

表示在分析范围内未发现可利用的漏洞——并不代表代码库完全安全。请查看

run.json

中的状态和成本是否符合

--max-budget

设置，若扫描因预算限制提前终止，需注明哪些路径未被审查。

Complementary tooling

配套工具

This is exploit-validated review, not an exhaustive inventory. Keep a dependency scanner (SCA) and secret scanning in place for complete coverage of known-CVE dependencies and committed credentials; use this for the logic, authorization, and injection bugs those tools structurally cannot find.

这是基于漏洞利用验证的审查，而非详尽的漏洞清单。请保留依赖扫描器（SCA）和密钥扫描工具，以全面覆盖已知CVE依赖项和已提交的凭据；本工具则用于检测那些工具在结构上无法发现的逻辑、授权和注入类漏洞。

Fix and verify

修复与验证

Hand results to fix-security-vulnerabilities-with-strix: patch the root cause (the shared authorization helper, not the one route), then re-run Strix to prove the exploit no longer works.

将结果交给fix-security-vulnerabilities-with-strix技能：修复根本原因（例如共享授权助手，而非单个路由），然后重新运行Strix以验证漏洞已无法被利用。