Trailmark turns code into graphs

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://blog.trailofbits.com/2026/04/23/trailmark-turns-code-into-graphs/
• Blog Title: Trailmark turns code into graphs
• Suggested Section: Generic Methodologies & Resources -> Fuzzing Methodology (add a subsection on graph-based fuzz target selection and mutation-testing triage) and/or Pentesting Web -> Source code Review / SAST Tools (as a code-graph + SARIF correlation technique/tool)

🎯 Content Summary

What this post is about
Trail of Bits open-sourced Trailmark, a library that parses source code into a queryable call graph (functions, classes, call relationships, plus semantic metadata like complexity metrics) and exposes it via a Python API intended to be called directly by Claude Code skills. The security thesis is that many important questions are graph questions (e.g., “can untrusted input reach this code, and what breaks if it’s wrong?”), whi...

🔧 Technical Details

Graph-first security triage (reachability + blast radius): Instead of treating tool output as a flat list, build a call graph of the codebase and ask graph queries such as “is there any path from an entrypoint/untrusted input handler to this sink?” and “how many security-critical operations depend on this node?”. Use callers/callees and paths_between to determine exploitability/reachability, and compute blast radius to prioritize fixes in high-dependency hubs.

Mutation-testing survivor classification using structural + mathematical constraints: When mutation testing yields surviving mutants, use graph context (calling paths and call-site constraints) plus domain invariants (e.g., arithmetic algorithms structurally bounding values) to separate equivalent mutants (behavior cannot change) from true security-relevant test gaps. Survivors that remain after filtering should be translated into targeted tests or fuzzing inputs, especially...

🤖 Agent Actions

I’m mapping the repo first, then I’ll read the most relevant fuzzing and source-review pages before deciding whether this belongs in one existing file or not.
I’ve narrowed it to the existing fuzzing methodology page and the web source-review/SAST page. Next I’m reading both, plus adjacent methodology pages, to see where Trailmark adds genuinely new technique rather than tool-only overlap.
The repo already has general fuzzing guidance, but not this specific “graph-first” triage workflow. I’m verifying the Trailmark details from the project sources now, then I’ll patch a single methodology page rather than splitting the content across sections.
I’ve made the placement decision: one addition to fuzzing.md is the cleanest fit. I’m patching it with the reusable methodology, not a tool advertisement, and I’ll keep the repo references at the end of the file.
Updated fuzzing.md with a new section on graph-first fuzz target selection and mutation triage.

The addition abstracts the Trailmark post into reusable methodology: intersecting complexity, untrusted-input reachability, and blast radius to choose fuzz targets; separating equivalent mutants from actionable survivors with graph context; and projecting SARIF findings onto graph nodes to prioritize harnesses. I kept it in a single existing file, added concise CLI/Python examples, and updated the ## References section with the Trail of Bits blog and Trailmark repo.

I reviewed the diff after editing and didn’t find existing HackTricks content covering this exact technique set.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://blog.trailofbits.com/2026/04/23/trailmark-turns-code-into-graphs/

Content Categories: Based on the analysis, this content was categorized under "Generic Methodologies & Resources -> Fuzzing Methodology (add a subsection on graph-based fuzz target selection and mutation-testing triage) and/or Pentesting Web -> Source code Review / SAST Tools (as a code-graph + SARIF correlation technique/tool)".

Repository Maintenance:

• MD Files Formatting: 972 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0