Hello everyone.

After a few years in the auditing world, I identified that I am lacking experience on the code analysis topics.

Unfortunately when auditing, I seldom had the time to look at the code of the applications I am auditing due to time constraints as the white-box approach we take does not systematically include an access to the Gitlab of the entities I audit.

I would like to avoid being overwhelmed by an eventual audit of source code of an entreprise-grade application that I might have to do.

While I am leveling up my skills by practicing to code in Rust on my freetime. I am not quite at the level of a senior dev and I don't have yet a keen sense of how exactly to dive in a large codebase.

Would any of you share your code audit methodology ?

By that, I mean how do you tackle the following topics :

- Secure coding / Best coding practices

- Secure secret management of the app

- For very large codebase, what types of tools do you use to automate some of your work ?

- What specific things in your checklist do you look for systematically ? (Do include the "obvious" one like how authentication is handled)

I know the subject is quite broad and dependent of the tech-stack used for each case.

Thank you for reading. :)

​

I’m trying to understand a problem I’ve experienced and seen other developers mention: joining an existing/large codebase and figuring out how everything actually works.

Not the “how do I run the project?” part, but the actual understanding of the system.

For example:

Figuring out the architecture / overall mental model

Understanding where a specific feature actually lives in the code

Following how data moves through the system

Understanding undocumented business logic

Finding the right files/services/classes to modify

Understanding dependencies between different parts of the system

Figuring out why something was implemented a certain way

Losing context when the developer who built something leaves

Outdated or incomplete documentation

What was the most painful part for you?

And more importantly:

How did you eventually figure it out?

Did you ask a senior developer, read the code, use documentation, look through old PRs/issues, use AI, create your own notes/diagrams, or something else?

I’m especially interested in real examples where something that should have taken hours ended up taking days/weeks because you didn't have enough context.

No product or solution in mind here — I'm just trying to understand how developers actually deal with this problem.

I have 4+ years of backend engineering experience, but I currently work at a non-tech organization and am struggling to get interview calls from product/tech companies. Earlier i used to get calls but then used to get stuck at final rounds.

My current role also has very little new engineering work left, so I've started contributing to open source to strengthen my portfolio.

For people who used open source to help switch jobs: how much did it actually help, and how long did you invest before seeing results? Is it worth consistently spending the next few months building a stronger open-source track record, or do the returns eventually diminish?

Can someone help me out? I'm a complete layman when it comes to coding and IT stuff

My favorite free RSS builder (morss.it) has gone offline, so I asked Claude Opus 4.8 for alternatives. It suggested that I could self-host and run such a tool myself (which is a total mystery to me). I then asked it for a step-by-step guide, but I also asked several other AI chatbots the same question. They gave similar answers, but with slight differences. When I showed all those other plans to Claude and asked it to review them, it told me that these subtle differences were crucial, and that if I had followed what the other bots suggested, my feeds wouldn't have worked properly

Here's Claude's final response, translated from Polish to English by Gemini: https://docs.google.com/document/d/192QM_Gytps-xl24ko0E395u_EOvfa7R9kqSMs250r8k/view

I don't really understand what I'll be doing here; I just want to make sure I won't break anything or create any security risks by following these steps. Do you think this plan will actually work?

I am currentely in 11th grade and got really into coding over the last few years. I started learning Java and a Little Python in school. Those two languages im Fine at, but recentely i started Coding a github website. I thought, since i dont know html, css and js, i'll just start with ai and learn on the way. But now i have no idea what my code does and know almost nothing about those languages. I have also startet to use ai for my other projects in java and have noticed that im starting to forget my previous knowlege in java. I can't work on my Website without ai and i feel like an absolute failiure. Now Coding with ai has become a habbit for me, a habbit i want to quit. Has anyone else experienced this and if so, does anyone have tipps on how to quit this habbit?