<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Performing Third-Party Code Audit — API Reference

## Semgrep

```bash
# Run curated security rules
semgrep --config "p/security-audit" --json target/

# Run OWASP rules
semgrep --config "p/owasp-top-ten" --json target/

# Custom rules
semgrep --config custom-rules/ --json target/

# Exclude test files
semgrep --config "p/security-audit" --exclude='*test*' --json target/
```

## Bandit (Python)

```bash
# Full scan with JSON output
bandit -r src/ -f json -o report.json

# Scan specific severity
bandit -r src/ -ll -f json

# Skip specific tests
bandit -r src/ -s B101,B601 -f json
```

## Code Metrics

```bash
# Lines of code by language
cloc target/ --json

# Complexity analysis
radon cc target/ -j -n C

# Maintainability index
radon mi target/ -j
```

