Insights & engineering guides
Practical guides to AI-assisted code security review.
Straight answers on how staged security review works, how to prevent duplicate AI findings, how to run reviews with local models or isolated Unix accounts, and where continuous repository review fits alongside pull-request checks and penetration tests.
Why one-shot AI prompts fail at repository security review
Why asking an AI model to find vulnerabilities in a single prompt produces false positives and shallow observations, and how staged review fixes it.
How to run AI vulnerability reviews without getting buried in duplicates
Why LLMs report the same vulnerability five different ways across runs, and how deterministic fingerprinting and asymmetric merge checks prevent duplicate findings.
Running AI code security review with local or self-hosted models
How engineering teams with strict source-code boundaries can run Dokima using OpenCode and privately hosted local models so repository contents never leave their infrastructure.
Pull-request security checks vs full-codebase review: why diffs miss serious bugs
Why reviewing only pull-request diffs leaves cross-file authorisation, trust-boundary and state vulnerabilities undetected, and how continuous codebase review closes the gap.
How small engineering teams can run continuous security review without a dedicated AppSec team
A practical workflow for 5-to-40-person engineering teams to find, triage and fix source-code vulnerabilities without hiring a full-time application security specialist.
Using Claude, Codex or OpenCode for defensive code review: permissions, isolation and risk
Practical operational guidance for running AI command-line tools on proprietary repositories, including read-only controls, restricted Unix accounts and Git credential separation.
Claude vs Codex vs OpenCode for source-code security review: choosing a runner and model
How Claude Code, OpenAI Codex CLI and OpenCode (including Gemini, open-weights and local models) compare when hunting and verifying software vulnerabilities.
Why SAST misses broken access control, IDOR and business-logic flaws (and how AI review finds them)
Why pattern-based static analysis struggles to detect missing authorisation checks and tenant isolation bugs, and how staged architectural review catches them.
Auditing AI-generated code: catching vulnerabilities introduced by coding assistants
Why AI coding assistants introduce plausible-looking security vulnerabilities across files, and how an independent staged review pipeline catches them before production.
Preparing for a penetration test or SOC 2 / ISO 27001 audit: cleaning up your codebase first
How engineering teams use staged full-repository security review before external pen tests and compliance audits to eliminate code vulnerabilities early.
How to cut false positives in AI code security review
Why naive AI security scanners hallucinate vulnerabilities, and how adversarial peer-review stages, upstream context gathering and confidence scoring eliminate noise.
Reviewing multi-repository and polyglot architectures for cross-service vulnerabilities
Why serious vulnerabilities hide at the boundaries between microservices, frontend apps and backend APIs, and how workspace-level AI security review uncovers them.
Using AI to strengthen cyber defence
What recent NCSC and Five Eyes guidance means for engineering teams using AI to improve source-code security review.
See the output directly
Inspect a real report or run Dokima on your own codebase.
Every guide in this collection reflects how Dokima runs in practice on Linux and macOS: building architectural context first, challenging candidate vulnerabilities before reporting them, and maintaining a deduplicated finding history across commits.
See what Dokima finds
Put an AI security reviewer to work on your codebase.
Start a full-product 21-day trial for your engineering team. No payment card required.