> For the complete documentation index, see [llms.txt](https://breachtrace.gitbook.io/vulnkeeper/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://breachtrace.gitbook.io/vulnkeeper/chapter-f/15-15-automated-vulnerability-detection-static-analysis-dynamic-analysis-and-resear.md).

# 15. Automated vulnerability detection, static analysis, dynamic analysis & research datasets

## 15.1 SAST / code query engines

<table><thead><tr><th width="89.2578125" align="right">Sl. #</th><th>Source Title</th><th>Notes</th></tr></thead><tbody><tr><td align="right">1</td><td><strong>CodeQL</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://codeql.github.com/">codeql.github.com</a><br><br><strong><code>Access / Cost</code>:</strong> Free for many open-source uses; GitHub Advanced Security commercial for private enterprise use</td><td><strong><code>Relevance</code>:</strong> Semantic code analysis engine for vulnerability discovery.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Strong for variant analysis &#x26; source-level detection.</td></tr><tr><td align="right">2</td><td><strong>CodeQL GitHub</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/github/codeql">github.com/github/codeql</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source public GitHub repo</td><td><strong><code>Relevance</code>:</strong> CodeQL source &#x26; query repository.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Use query packs for detection logic examples.</td></tr><tr><td align="right">3</td><td><strong>CodeQL query packs</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/github/codeql/tree/main">github.com/github/codeql/tree/main</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source public GitHub repo</td><td><strong><code>Relevance</code>:</strong> Query packs for multiple languages.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Queries can be adapted for custom vuln detection.</td></tr><tr><td align="right">4</td><td><strong>Semgrep</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://semgrep.dev/">semgrep.dev</a><br><br><strong><code>Access / Cost</code>:</strong> Free/open-source CLI; commercial Semgrep products available</td><td><strong><code>Relevance</code>:</strong> Pattern-based static analysis.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Good for fast custom rule writing.</td></tr><tr><td align="right">5</td><td><strong>Semgrep rules</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/semgrep/semgrep-rules">github.com/semgrep/semgrep-rules</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source public GitHub repo</td><td><strong><code>Relevance</code>:</strong> Community/official Semgrep rules.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Validate rule precision before production blocking.</td></tr><tr><td align="right">6</td><td><strong>Joern</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://joern.io/">joern.io</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source core</td><td><strong><code>Relevance</code>:</strong> Code property graph platform.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for research-grade vulnerability discovery.</td></tr><tr><td align="right">7</td><td><strong>Joern GitHub</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/joernio/joern">github.com/joernio/joern</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source public GitHub repo</td><td><strong><code>Relevance</code>:</strong> Joern implementation.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for custom graph queries &#x26; ML pipelines.</td></tr><tr><td align="right">8</td><td><strong>Facebook Infer</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://fbinfer.com/">fbinfer.com</a><br><br><strong><code>Access / Cost</code>:</strong> Free public / open-source</td><td><strong><code>Relevance</code>:</strong> Static analyzer for multiple languages.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for null deref, resource leaks, concurrency, &#x26; related bug classes.</td></tr><tr><td align="right">9</td><td><strong>Infer GitHub</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/facebook/infer">github.com/facebook/infer</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source public GitHub repo</td><td><strong><code>Relevance</code>:</strong> Infer source repository.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Reference implementation.</td></tr><tr><td align="right">10</td><td><strong>SonarQube rules</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://rules.sonarsource.com/">rules.sonarsource.com</a><br><br><strong><code>Access / Cost</code>:</strong> Free public rules catalog; Sonar products include free &#x26; commercial tiers</td><td><strong><code>Relevance</code>:</strong> SonarSource rule catalog.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for mapping code quality/security rules to weakness classes.</td></tr><tr><td align="right">11</td><td><strong>Bandit - Python</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/PyCQA/bandit">github.com/PyCQA/bandit</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source public GitHub repo</td><td><strong><code>Relevance</code>:</strong> Python security linter.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for Python SAST coverage.</td></tr><tr><td align="right">12</td><td><strong>Gosec - Go</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/securego/gosec">github.com/securego/gosec</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source public GitHub repo</td><td><strong><code>Relevance</code>:</strong> Go security checker.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for Go SAST.</td></tr><tr><td align="right">13</td><td><strong>ESLint security plugin</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/eslint-community/eslint-plugin-security">github.com/eslint-community/eslint-plugin-security</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source public GitHub repo</td><td><strong><code>Relevance</code>:</strong> JavaScript security lint rules.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for JS static checks.</td></tr><tr><td align="right">14</td><td><strong>SpotBugs</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://spotbugs.github.io/">spotbugs.github.io</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source</td><td><strong><code>Relevance</code>:</strong> Java static analysis.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> General bug detection; pair with FindSecBugs for security.</td></tr><tr><td align="right">15</td><td><strong>FindSecBugs</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://find-sec-bugs.github.io/">find-sec-bugs.github.io</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source</td><td><strong><code>Relevance</code>:</strong> Java security bug detection plugin.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for Java/JVM SAST.</td></tr><tr><td align="right">16</td><td><strong>Clang Static Analyzer</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://clang-analyzer.llvm.org/">clang-analyzer.llvm.org</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source</td><td><strong><code>Relevance</code>:</strong> C/C++/Objective-C static analyzer.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for native code vulnerability classes.</td></tr><tr><td align="right">17</td><td><strong>Cppcheck</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://cppcheck.sourceforge.io/">cppcheck.sourceforge.io</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source</td><td><strong><code>Relevance</code>:</strong> C/C++ static analyzer.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Complements compiler analyzers.</td></tr><tr><td align="right">18</td><td><strong>Flawfinder</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://dwheeler.com/flawfinder/">dwheeler.com/flawfinder</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source</td><td><strong><code>Relevance</code>:</strong> C/C++ security scanner for dangerous functions.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Fast heuristic scanner with false-positive risk.</td></tr><tr><td align="right">19</td><td><strong>Brakeman - Ruby on Rails</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://brakemanscanner.org/">brakemanscanner.org</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source</td><td><strong><code>Relevance</code>:</strong> Ruby on Rails static security scanner.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for Rails-specific vulnerability patterns.</td></tr><tr><td align="right">20</td><td><strong>Horusec</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/ZupIT/horusec">github.com/ZupIT/horusec</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source public GitHub repo</td><td><strong><code>Relevance</code>:</strong> Multi-language security scanner.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for broad SAST coverage.</td></tr><tr><td align="right">21</td><td><strong>Bearer</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/Bearer/bearer">github.com/Bearer/bearer</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source public GitHub repo</td><td><strong><code>Relevance</code>:</strong> Code security/privacy scanner.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for data-flow &#x26; sensitive data exposure detection.</td></tr><tr><td align="right">22</td><td><strong>MobSF</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/MobSF/Mobile-Security-Framework-MobSF">github.com/MobSF/Mobile-Security-Framework-MobSF</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source public GitHub repo</td><td><strong><code>Relevance</code>:</strong> Mobile security testing framework.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for Android/iOS static &#x26; dynamic app analysis.</td></tr><tr><td align="right">23</td><td><strong>zizmor</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/zizmorcore/zizmor">github.com/zizmorcore/zizmor</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source public GitHub repo</td><td><strong><code>Relevance</code>:</strong> Static analysis for GitHub Actions.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for CI/CD workflow security, GitHub Actions hardening, &#x26; supply-chain pipeline risk detection.</td></tr><tr><td align="right">24</td><td><strong>OpenAnt</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/knostic/OpenAnt">github.com/knostic/OpenAnt</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source public GitHub repo</td><td><strong><code>Relevance</code>:</strong> LLM-based vulnerability discovery product focused on verified security flaws &#x26; reduced false positives.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful as AI-assisted vulnerability discovery tooling. Validate findings against primary evidence before treating as confirmed vulnerabilities.</td></tr></tbody></table>

## 15.2 DAST, IAST, fuzzing & dynamic test sources

<table><thead><tr><th width="92.4296875" align="right">Sl. #</th><th>Source Title</th><th>Notes</th></tr></thead><tbody><tr><td align="right">1</td><td><strong>OSS-Fuzz</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://google.github.io/oss-fuzz/">google.github.io/oss-fuzz</a><br><br><strong><code>Access / Cost</code>:</strong> Free for eligible open-source projects</td><td><strong><code>Relevance</code>:</strong> Continuous fuzzing for open-source projects.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for vulnerability discovery &#x26; bug lifecycle data.</td></tr><tr><td align="right">2</td><td><strong>OSS-Fuzz GitHub</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/google/oss-fuzz">github.com/google/oss-fuzz</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source public GitHub repo</td><td><strong><code>Relevance</code>:</strong> OSS-Fuzz project configuration repository.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for project fuzzing coverage &#x26; harness examples.</td></tr><tr><td align="right">3</td><td><strong>OSS-Fuzz vulnerability data in OSV</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://osv.dev/list?ecosystem=OSS-Fuzz">osv.dev/list?ecosystem=OSS-Fuzz</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> OSV records from OSS-Fuzz vulnerabilities.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Good for linking fuzz-discovered vulnerabilities to OSV schema.</td></tr><tr><td align="right">4</td><td><strong>ClusterFuzzLite</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://google.github.io/clusterfuzzlite/">google.github.io/clusterfuzzlite</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source</td><td><strong><code>Relevance</code>:</strong> Lightweight continuous fuzzing for CI/CD.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for integrating fuzzing into development pipelines.</td></tr><tr><td align="right">5</td><td><strong>AFL++</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/AFLplusplus/AFLplusplus">github.com/AFLplusplus/AFLplusplus</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source public GitHub repo</td><td><strong><code>Relevance</code>:</strong> Coverage-guided fuzzer.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Good for native code vulnerability discovery.</td></tr><tr><td align="right">6</td><td><strong>libFuzzer</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://llvm.org/docs/LibFuzzer.html">llvm.org/docs/LibFuzzer.html</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source LLVM component</td><td><strong><code>Relevance</code>:</strong> In-process coverage-guided fuzzer.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Common with LLVM sanitizers.</td></tr><tr><td align="right">7</td><td><strong>Honggfuzz</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/google/honggfuzz">github.com/google/honggfuzz</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source public GitHub repo</td><td><strong><code>Relevance</code>:</strong> Security-oriented fuzzer.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for native code dynamic testing.</td></tr><tr><td align="right">8</td><td><strong>Jazzer</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/CodeIntelligenceTesting/jazzer">github.com/CodeIntelligenceTesting/jazzer</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source public GitHub repo</td><td><strong><code>Relevance</code>:</strong> JVM fuzzing engine.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for Java/Kotlin fuzz testing.</td></tr><tr><td align="right">9</td><td><strong>OWASP ZAP</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://www.zaproxy.org/">www.zaproxy.org</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source</td><td><strong><code>Relevance</code>:</strong> Web application dynamic security scanner.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for DAST &#x26; app exposure validation.</td></tr><tr><td align="right">10</td><td><strong>Nuclei</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/projectdiscovery/nuclei">github.com/projectdiscovery/nuclei</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source public GitHub repo; commercial ecosystem separate</td><td><strong><code>Relevance</code>:</strong> Template-based vulnerability &#x26; exposure scanner.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for automated exposed-service checks.</td></tr><tr><td align="right">11</td><td><strong>Nuclei templates</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/projectdiscovery/nuclei-templates">github.com/projectdiscovery/nuclei-templates</a><br><br><strong><code>Access / Cost</code>:</strong> Free / open-source public GitHub repo</td><td><strong><code>Relevance</code>:</strong> Community/official detection templates.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Template quality varies; review false-positive potential.</td></tr></tbody></table>

## 15.3 Vulnerability-detection research datasets

<table><thead><tr><th width="90.3203125" align="right">Sl. #</th><th>Source Title</th><th>Notes</th></tr></thead><tbody><tr><td align="right">1</td><td><strong>NIST SARD</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://samate.nist.gov/SARD/">samate.nist.gov/SARD</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Software Assurance Reference Dataset.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for evaluating static analysis tools &#x26; ML models.</td></tr><tr><td align="right">2</td><td><strong>Juliet Test Suite - NIST SARD</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://samate.nist.gov/SARD/test-suites/112">samate.nist.gov/SARD/test-suites/112</a><br><br><strong><code>Access / Cost</code>:</strong> Free public</td><td><strong><code>Relevance</code>:</strong> Synthetic test cases for many vulnerability classes.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for controlled evaluation, but may not reflect real-world code complexity.</td></tr><tr><td align="right">3</td><td><strong>Big-Vul</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/ZeoVan/MSR_20_Code_vulnerability_CSV_Dataset">github.com/ZeoVan/MSR_20_Code_vulnerability_CSV_Dataset</a><br><br><strong><code>Access / Cost</code>:</strong> Free public GitHub repo; verify license</td><td><strong><code>Relevance</code>:</strong> Large vulnerability dataset derived from real-world CVE-fix commits.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Validate deduplication, labels, &#x26; train/test leakage.</td></tr><tr><td align="right">4</td><td><strong>Devign</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://sites.google.com/view/devign">sites.google.com/view/devign</a><br><br><strong><code>Access / Cost</code>:</strong> Free public research page; verify dataset access/license</td><td><strong><code>Relevance</code>:</strong> Vulnerability detection dataset.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Used in ML vuln detection research.</td></tr><tr><td align="right">5</td><td><strong>Draper VDISC</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://osf.io/d45bw/">osf.io/d45bw</a><br><br><strong><code>Access / Cost</code>:</strong> Free public OSF dataset; verify license/terms</td><td><strong><code>Relevance</code>:</strong> Vulnerability discovery dataset.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for ML baselines; inspect labeling quality.</td></tr><tr><td align="right">6</td><td><strong>DiverseVul</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/wagner-group/diversevul">github.com/wagner-group/diversevul</a><br><br><strong><code>Access / Cost</code>:</strong> Free public GitHub repo; verify license</td><td><strong><code>Relevance</code>:</strong> Diverse vulnerability dataset.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for model training/evaluation; check license &#x26; label quality.</td></tr><tr><td align="right">7</td><td><strong>PrimeVul</strong><br><br><strong><code>Link(s)</code>:</strong> <a href="https://github.com/DLVulDet/PrimeVul">github.com/DLVulDet/PrimeVul</a><br><br><strong><code>Access / Cost</code>:</strong> Free public GitHub repo; verify license</td><td><strong><code>Relevance</code>:</strong> Vulnerability detection benchmark dataset.<br><br><strong><code>Notes &#x26; POIs</code>:</strong> Useful for modern ML vulnerability detection benchmarking.</td></tr><tr><td align="right">8</td><td>MegaVul</td><td><a href="https://github.com/Icyrockton/MegaVul">github.com/Icyrockton/MegaVul</a></td></tr><tr><td align="right">9</td><td>Vul4J</td><td><a href="https://github.com/tuhh-softsec/vul4j">github.com/tuhh-softsec/vul4j</a></td></tr><tr><td align="right">10</td><td>VulnCode-DB</td><td><a href="https://github.com/vegardit/vulncode-db">github.com/vegardit/vulncode-db</a></td></tr><tr><td align="right">11</td><td>SecurityEval</td><td><a href="https://github.com/s2e-lab/SecurityEval">github.com/s2e-lab/SecurityEval</a></td></tr><tr><td align="right">12</td><td>CVEfixes</td><td><a href="https://github.com/secureIT-project/CVEfixes">github.com/secureIT-project/CVEfixes</a></td></tr><tr><td align="right">13</td><td>Defects4J</td><td><a href="https://github.com/rjust/defects4j">github.com/rjust/defects4j</a></td></tr><tr><td align="right">14</td><td>ManySStuBs4J</td><td><a href="https://github.com/mast-group/mineSStuBs">github.com/mast-group/mineSStuBs</a></td></tr><tr><td align="right">15</td><td>VulDeePecker</td><td><a href="https://github.com/CGCL-codes/VulDeePecker">github.com/CGCL-codes/VulDeePecker</a></td></tr></tbody></table>

## Discussion

This chapter section keeps the latest table structure, source titles, access/cost fields, relevance notes, & operational notes from the source inventory. Review the table entries as ingestion candidates, then validate source freshness, licensing, authentication requirements, & link-check behavior before production use.

***

#### [Back to Index](/vulnkeeper/index.md)


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://breachtrace.gitbook.io/vulnkeeper/chapter-f/15-15-automated-vulnerability-detection-static-analysis-dynamic-analysis-and-resear.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.