TLDR Tech / InfoSec
How to scan for vulnerabilities with GitHub Security Lab's open source AI-powered framework
GitHub Security Lab's open source Taskflow Agent employs a multi-stage LLM pipeline — threat modeling, issue suggestion, and thorough audit — to detect high-impact auth bypasses, IDORs, and logic flaws with a low hallucination rate. It has identified over 80 vulnerabilities across more than 40 repositories so far. Out of 1,003 suggested issues, only 21% met the criteria for impactful reporting, with business logic flaws having the highest true-positive rate at 25%, and IDOR issues exceeding combined XSS and CSRF cases. Notable confirmed findings include a privilege escalation in Outline (CVE-2025-64487), PII exposure in WooCommerce (CVE-2025-15033) and Spree (CVE-2026-25758), and a universal authentication bypass in Rocket.Chat's microservices DDP layer (CVE-2026-28514) caused by a missing await on a bcrypt Promise.
Read the full story