A new guide from Eugene Yan outlines a structured approach to applying large language models to source code security. The workflow begins with constructing a threat model, which helps developers and security engineers understand where an application might be attacked. This step sets the context for the rest of the process.
Next, LLMs are used to scan the codebase for potential vulnerabilities. The guide emphasizes that discovery alone is not enough—each finding must be verified to avoid false positives. After verification, the issues are triaged by severity and then patched, with LLMs suggesting fixes that developers can review and apply.
Because this is a single source, there are no conflicting viewpoints to compare. The guide presents a coherent pipeline that integrates LLMs into existing security practices rather than replacing human judgment. It positions LLMs as powerful assistants that can speed up the tedious parts of security analysis while leaving final decisions to humans.