Choose a starting point
Start from the workload and what you can operate safely. The same repository may need more than one of these workflows.
| Your task | When to use | Remaining gap |
|---|---|---|
| Existing app with supported-language source | CodeQL for query-based security findings you can triage. | Confirm access requirements and framework modeling; review behavior with tests. |
| Research batch of generated programs | ScaleBox when you can operate execution infrastructure and validate its judges. | Isolation, resource limits and judge correctness need a deployment review. |
| Small core with a precise contract | Dafny when writing and maintaining a specification is justified. | The contract must represent the property and assumptions you actually need. |
| Pull request needing contextual review | Repository-aware AI review to propose defects or additional tests. | Reproduce findings and check private-source access policy before adoption. |
Use the guide’s scope questions to separate application review from benchmark evaluation.
CodeQL: query code for security findings
CodeQL builds a database representation of code and runs queries against it. GitHub can display results as code-scanning alerts. The official documentation lists supported languages and access requirements.
Consider it when you need automated security analysis in CI. Confirm language and framework coverage, interpret alerts in context, and review the current CodeQL terms before use in a private repository. It does not establish that an application meets its business requirements.
Read CodeQL documentation ↗ScaleBox: execute and evaluate generated programs
ScaleBox is an Apache-2.0-licensed project for code execution and evaluation infrastructure. Its documentation describes parallel execution, configurable limits and several evaluation interfaces.
It fits research workflows that evaluate generated programs. Deploying it requires an isolation and operations review appropriate to the code you will execute. A sandbox label alone does not establish a sufficient security boundary.
Dafny: specify and verify program properties
Dafny is a verification-aware programming language. Its reference explains contracts, invariants and the language’s verification model. The project’s source is available under MIT; check the licenses of bundled dependencies separately.
Use it when a precise property justifies the effort of writing specifications and discharging proof obligations. Existing application code does not become verified simply by describing it to an assistant.
Read the Dafny language reference ↗Repository-aware AI review
An AI reviewer can suggest defects and tests using repository context. OpenAI’s research discusses the tradeoff between useful findings and false alarms. Teams still need a process to reproduce the reported issue and decide whether it matters.
Before connecting a service to private source, check repository access, data handling and organizational policy. This directory does not upload repositories or connect to a review provider.
Read OpenAI’s verification research ↗