Threat model file
Direct answerA scope document the tool reads before scanning (zkao's zkao.md, Codex Security's generated threat model) stating trust boundaries, adversaries and out-of-scope behaviour.
In more detail
It is the single cheapest false-positive reducer on this index. Write it before the first scan.
Tools that address it
zkao, Codex Security (formerly Aardvark).
Related terms
False positive rate, Precision vs recall, Agentic scanning, LLM plus fuzzing, LLM plus symbolic execution or formal verification, Hallucinated vulnerabilities, Triage burden, Benchmark contamination, Human-in-the-loop, AI-assisted audit vs AI audit, Prompt injection in auditing pipelines, Responsible disclosure of AI-found bugs, Continuous scanning and run-count coverage, Proof-of-concept harness, Severity calibration
Getting help
Firms on this index that handle this in practice: zkSecurity, Trail of Bits, Zellic, Nethermind Security.