Guillaume Marty

What an agent can do with the github-security-researcher corpus

LemonCondor/github-security-researcher: Policy-gated toolkit for security and bug research on public open source code. LLM analysis alone cannot produce CONFIRMED

• Look up how github-security-researcher implements bug-hunting, golang, llm, with answers cited to file and line.
• Reuse a worked example: the commit “Add agentic logic-bug hunting (gsr hunt): Python/Go/JS, deterministic…” (19 files · Python).
• Answer from github-security-researcher's real Python source instead of memory (Security and vulnerabilities).

• How does github-security-researcher implement bug-hunting?
• What does src/github_security do in github-security-researcher?

Search the GitHub repository LemonCondor/github-security-researcher with XERJ (https://hub.xerj.org/corpus/lemoncondor--github-security-researcher).
Run these in a shell, in order, and check each result before the next:
1. xerj --help  (success: it prints usage). If xerj is missing: curl -fsSL https://xerj.org/get | sh
2. git clone https://github.com/LemonCondor/github-security-researcher github-security-researcher && git -C github-security-researcher checkout 5b97ab5b23fa83f739f98f9748faf9265a57058e
3. Start a local node and leave it running: xerj --insecure --data-dir ./xerj-data
4. xerj autoindex ./github-security-researcher --url http://127.0.0.1:9200 --prefix github-security-research --progress plain
5. xerj autoindex map --url http://127.0.0.1:9200
Then answer my question from the indexed files and cite the ax_path of every hit. Query syntax: https://xerj.org/llms.txt
Licence: Apache-2.0. Keep the copyright notice and credit the authors.

corpus lemoncondor--github-security-researcher · Security and vulnerabilities
Related corpora: gosec-rules, garak, Nephilex/nephilex, Actenon/actenon-scan
Code security audit with XERJ · Case study: reference coding for agents