hunting-bugs-with-a-code-graph

# Hunting bugs with a code graph Grep finds strings; it misses the caller behind a rename, an alias, or an import indirection, and it cannot answer "what can flow into this argument." Reasoning over a codebase's *structure* - its call graph and dataflow - can. This skill is the master loop for a source-level hunt. Two companions go deeper on single moves: `adjudicating-taint-paths` (lead → decided finding) and `auditing-guard-gaps` (the unguarded peer of a guarded function). ## When to use - You have source and want *coverage*, not a one-off keyword search. - You're cold on an unfamiliar codebase and need to find where input arrives. - You want to work a bug *taxonomy* systematically and prove what you ruled out. ## Scope check (do this first) Only run on code you're authorized to analyze: your own, an OSS project you contribute to, a CTF, or an engagement where source review is in scope. If you can't name why you're allowed to read this source, stop. ## The loop 1. **Index the target.** Build a structural index of the source tree. It is a *snapshot* - re-index whenever the code changes in a way that matters, or you will adjudicate against stale structure. 2. **Orient before hunting.** Start from the most-connected functions - the structural spine, where input arrives and trust boundaries sit - not from a file you happened to open. Map the top-level entry points and the module layout before drilling in. 3. **Enumerate the whole taxonomy - never one fam...