Tools

Fast regex search across directories (command rg) that respects .gitignore, skips hidden and binary files by default and filters by file type. A go-to command for coding agents searching a codebase.

Semantic multi-language static analysis: find vulnerabilities and bugs with rules that look like source code, across 30+ languages with custom rules. Scans locally by default without uploading code; cross-file analysis and Pro rules require sign-in.

From Trail of Bits: starts from one confirmed vulnerability, distills its root cause, then writes and progressively generalizes CodeQL/Semgrep queries to find similar variants across the codebase and report them by severity.