GB/T Code Security Audit

Compliance-oriented code auditing

Security acceptance reviews often split into two needs: locating risky API calls quickly, and reasoning about context-dependent issues such as business logic and cross-file data flow. gbt-code-audit targets Java, C/C++, C#, and Python code, using GB/T 34943, GB/T 34944, GB/T 34946, and GB/T 39412 as the basis for classifying and grading findings. It produces a traceable Markdown audit report where each issue includes code snippets, line numbers, severity, GB/T mapping, problem description, and remediation advice.

Dual-engine workflow and limits

The workflow has three layers: quick_scan uses regex patterns to detect high-risk function calls and writes findings/baseline/*.md; an LLM checks context, marks baseline findings as valid or false positives, records missed issues in findings/llm_audit/*.md, and can run in parallel agents; finalize_report deduplicates by file:line:type, validates format and line numbers, and outputs audit_report_*.md. Coverage includes command execution, SQL construction, file operations, weak encryption, hardcoded credentials, authentication/authorization, state transitions, concurrency, and memory-safety issues.

Use it for project acceptance, compliance review, and code quality assessment, not as the sole security test. It assumes readable source code, a clear directory layout, and accurate line references. Obfuscated code, missing context, or private protocols may leave complex vulnerabilities undiscovered, so pair it with manual review and dynamic testing.