ThailandJohn

lol... thats bit embarrassing I copy paste my memo note too... ohh well. It doesnt change much lol, it was supposed to end up here anyhow and now it did xD <3

Not exactly how it works but I do understand the concern. The other option is to "just give it away" by not having it and being sherlocked... Now? You have to ask permission first, commercial licensing is a thing.

Why not?

Would be really cool to compare notes :D Sent from a "non tech" company email so it doesn't get filtered lol.

My speed really depends on language and what needs indexing. On pure Python projects I get around 220k loc/min, but for deeper data flow in Node apps (TypeScript compiler overhead + framework extraction) it's roughly 50k loc/min.

Curious what your stack is and what depth you're extracting to reach 1M/min - those are seriously impressive numbers! :D

Hey! Yes I did. I started with treesitter tbh. And for go, rust, bash and hcl? I still do. In my naive beginnings, i really had no idea how complex things "were supposed to be", so i was never really deterred for it and kept building it piece by piece and very quickly? (Because I wanted "everything"). I hit hard limitations with treesitter, not only for "taint resolution" but overall what I could check, what I could do...

It "starts with symbols", you get the basic starter kit but then quickly it became "this proves it exists" but "not what it does". Which meant taint couldn't work properly because you want to track assigments, function call arguments etc to see how the data actually flows. Same thing with the rules engine. Without tracking object literals? xss detection becomes very shallow with tons of false positives because treesitter wont be able to tell you property assigments or call methods.

And it feels like it keeps going like that for infinity with various aspects and things I wanted know and track. So all in all? Moving away from treesitter and taking on the "mountain" allowed me (after losing weeks of sanity lol) to incrementally build out virtually anything i wanted to extract or check....It does sadly leave some "money on the table" for other languages, take rust as an example? Due to treesitter the taint engine is limited to no cross module resolution and type checking. So that's why :)

Hi! Limitations of tree sitter, its insanely fast, easy to use but hits a limit on syntax/nodes only. Typescript compiler provides semantic with full type checking and cross module resolution. Its a small nightmare as I have to write every extraction and parser for it (why i call it "pseudo compiler"). Its a necessity to gain full call chain provenance across callee/caller, framework and validations, which is a "hard" requirement for the taint analysis to work. If you want to get down into code for it? The top layer is ast_parser.py which routes a few places but taking js/ts as an example? look at data_flow.ts / javascript.py which shows the ast/extraction/analyzing layers to capture and make sense of it in the database. :)

Hi HN, OP here.

I’m a former Enterprise Systems Architect (Cisco/VMware) turned "vibe coder." I realized quickly that AI coding is dangerous because LLMs lack *context* and *verification*. They hallucinate because they are guessing at the file structure.

So, out of pure spite for flaky tools, I built *TheAuditor*.

*The Concept:* Instead of grepping files, I index the entire repo (Python, TS, Go, Rust, Terraform, CDK) into a local SQLite database (~180MB for a mid-sized repo). Because the code is in a DB, I can query the call graph like SQL.

*The Tech (The "Hard" Part):* I needed a way to trace data flow through the infrastructure to prevent the AI from introducing vulnerabilities. I ended up building a *Hybrid Taint Engine* that extends the Oracle Labs (2021) IFDS research: 1. *Forward Flow:* Traces entry points to reachable sinks to prune the graph. 2. *Backward IFDS:* Runs a precise "Interprocedural Finite Distributive Subset" analysis on the pruned graph. 3. *The Handshake:* We only report vulnerabilities where both engines intersect.

*The "Systems Architect" approach:* Coming from a background in critical infrastructure, I hate silent failures. I implemented a *5-Layer Fidelity System*. Every parser emits a cryptographic manifest. If the DB storage receipt doesn't match the manifest (transaction mismatch or data loss), the tool hard-crashes. I'd rather a stack trace than a false negative.

*Why I built it:* I use this as a "Flight Computer" for my AI agent. * Before refactoring, it runs `aud impact` to calculate the blast radius. * Before writing code, it runs `aud explain` to get a token-optimized context bundle of definitions.

This is v2 (a complete rewrite after 800 commits). I learned a lot since my first attempt. The code is open source (AGPL).

Happy to answer questions about the SQLite schema or the IFDS implementation.

Yeh, i dont dont use nix so when asked to follow the link? It didnt work as it should. And because i dont use nix? Hard to catch it until my friend did...

That said? Did you the hash fail? Yes it did, security working as intended... Anything more to add? :)

No? At least read couple lines in the readme before joining the discussion please.