Scan code, find an exploit, VERIFY THE EXPLOIT, write a clean patch and submit it. One of the biggest issues with using LLMs for security purposes, is it makes shit up all of the time. So many false positives submitted by people who don’t understand what they are doing is a huge part of why people don’t accept slop security reports any more.