What an LLM Can Find: A Practical, Cheap Path to Code-level Threat Discovery

An LLM-assisted code audit of the GlobaLeaks whistleblowing platform (conducted at a cost of roughly USD 3,140 in API calls) identified 110 triaged records — 29 confirmed vulnerabilities, 12 denial-of-service issues, 42 hardening recommendations, and 27 retained non-findings — demonstrating that large-scale, inexpensive LLM-enabled code review can uncover ordinary but impactful issues (session takeover paths, anonymity and tenant-boundary risks, missing audit logs, and availability weaknesses) even in a recently hardened codebase; every candidate was human-validated before being confirmed.