Challenge
A narrow signature can miss variants, while a broad static rule can flood the researcher with false positives. The useful result is a short, traceable lead list that still requires manual validation.
Project case study
kameHunt
An LLM-assisted variant-analysis engine that validates and ranks static-analysis matches into a short list of manually-verifiable leads.
Context
Why it exists and what I built.
Design decision
Separate broad detection from validation. Semgrep gathers candidates, provenance-aware heuristics remove obvious noise, an optional LLM pass helps rank the remainder, and the researcher makes every security decision.
Contribution
Designed and built the detection, heuristic validation, optional LLM triage, benchmark, CI-tested workflow, and kameReport-compatible export path.
Outcome
In a documented seven-case experiment, the broader rule surfaced six candidate patterns instead of none. Each output remains an unverified lead.
How it works
Four stages from input to evidence.
Model the bug
Translate a known weakness into a deliberately broad source signature.
Collect candidates
Use Semgrep to find code that may share the relevant data-flow shape.
Reduce noise
Apply provenance-aware heuristics and optional LLM ranking.
Validate manually
Review the short list and confirm behavior outside the tool.
Evidence and limits
What the source supports.
What the project demonstrates
- The reviewed repository has a CI-run test suite.
- A false-positive-reduction benchmark is included.
- In a documented seven-case experiment, the broader rule surfaced six candidate patterns instead of none.
What the project does not claim
- Every result is an unverified research lead.
- The tool reads code and carries no exploitation or disclosure capability.
- Optional LLM output cannot replace source review, reproduction, or coordinated disclosure judgment.
CyberKareem/kameHuntSource snapshot at commit 6a6eac1123a02d150945878a798c47e8af752963. Later repository changes are outside this case study.
Inspect pinned revision opens in a new tab