The pipeline finds security-relevant code, scans for vulnerabilities, reproduces them in isolated environments, tests whether they can be exploited, and generates candidate patches.

Human researchers review the results before reporting vulnerabilities and propose fixes to maintainers.