A finding is a lead, not a verdict.

The run takes a read-only snapshot, maps the application, and combines model-assisted review with deterministic scanners: Semgrep, Gitleaks, pip-audit and OSV-Scanner.

It ends in two artifacts rather than one. An engineering backlog with concrete remediation work, and a leadership memo that states risk in business terms. You do not need a security background to run it, which is the point: the people who inherit a codebase in an acquisition usually do not have one.

Model lenses and scanners contribute findings with source attribution and code citations, and a citation must resolve exactly to repository source before anything is written down. A unique location corrects a misattributed file or range; an absent or ambiguous one is logged and rejected rather than becoming a malformed finding.

Two lenses sharing a model count as correlated agreement, not as independent corroboration. Only a different evidence mechanism or a distinct deterministic tool earns that.

A bounded falsification loop checks reachability, attacker control and mitigating controls, and confirms, kills, defers or leaves the candidate unresolved. It never silently drops an inconclusive result.

For Python SQL injection, command injection and SSRF candidates a local def-use slice adds source, assignment and sink evidence, and is explicitly non-authoritative. A structurally_verified claim means those exact facts closed under an independently versioned checker that reopened the pinned snapshot. It does not mean the finding is exploitable.

Undecided review requests block final analysis outright. Decisions and later corrections are append-only and require a rationale, so the audit trail survives somebody changing their mind.

Analysis then keeps technical and financial judgement apart. Deal-risk weighting prioritises diligence without overwriting technical severity, and the FAIR-style Monte Carlo pass reports a loss range and an exceedance curve rather than one confidently precise number.

Comments and docstrings that read like instructions are delimited as untrusted evidence at the detect and falsify model boundaries. A prompt planted in a source file cannot replace the stage policy or the output contract.

That matters more here than in most tools, because the whole job is pointing a model at code written by someone you have no reason to trust.