Hey everyone!

I’m relatively new to vulnerability research and interested in finding vulnerabilities in open-source frameworks and libraries (like Spring Security, LangChain, etc.).

I’ve been trying to understand how experienced researchers actually approach large codebases, rather than just looking for known CVEs.

I’m especially curious about a few things:

Where do you start? Do you usually study previous CVEs and patches, identify security-critical components, or just dive into the source code?

What techniques do you rely on most? Manual code review, fuzzing, static analysis tools like CodeQL, or some combination of these?

Has LLM changed your workflow?…