all research
Everything I've published,
in one feed.
3 posts across writeups, research, and technical deep-dives. Filter by tag.
2026.04.08
Semgrep Architecture: Comprehensive Reference
A deep technical reference on how Semgrep works internally - from CLI entry-point and target discovery, through parsing, AST normalisation, pattern matching and taint dataflow analysis, to output formatting.
17 min
2025.08.05
Understanding Code Property Graphs
Why AST, CFG, and PDG each fall short for security review, and how Code Property Graphs unify them into one queryable structure, with an intro to Joern.
22 min
2025.08.02
Code auditing 101
A tour of code auditing fundamentals: manual review vs SAST, taint analysis, sink-to-source vs source-to-sink, and picking a SAST tool people will use.
21 min