Trailmark turns code into graphs
Summary: Trail of Bits open-sourced Trailmark, an Apache-2.0 library that parses source code into a queryable call graph of functions, classes, call relationships, and semantic metadata, exposed through a Python API that Claude skills call directly, supporting 17 languages including C, Rust, Go, Python, PHP, JavaScript, Solidity, Circom, and Miden Assembly. In an Ed448 Go implementation, mutation testing produced 45 surviving mutants out of 583 covered, and graph-based triage classified 33 of the 45 (73%) as equivalent mutants, leaving 12 genuine gaps.
What you should know: In libhydrogen, the graph showed the entire library funnels through a single permutation primitive, gimli_core_u8, with 37 direct calls, so a flaw there affects 100% of the library's security-critical functionality - and Gimli was eliminated from the NIST Lightweight Cryptography competition.
Read the original at Trail of Bits Blog ↗
- Topics
- Endpoint & Network Security
- Related
- Adapting to AI penetration testing orchestrators: The Modern Security Model Cyber Risks · Nov 13, 2026Introducing Spend Management: Spending limits and alerts for Cloudflare Cyber Risks · Nov 13, 2026Choosing Que Paxa, an unusual consensus algorithm Cyber Risks · Nov 11, 2026