Sanitized bug-finding examples
Use code evidence to find real bug classes.
These examples are synthetic and fully sanitized. They are based on
bug patterns that lmprobe can surface, but they do not include real
proprietary code, product names, company names, repository paths,
service endpoints, credentials, or customer data.
Evidence first
{
"schema": "lmprobe.grep.v1",
"exit_status": "matched",
"hits": [
{
"file_path": "src/services/ScheduleService.java",
"line_number": 7,
"line_content": "dailyRepository.findByDate(day);"
}
],
"warnings": []
}
Case 1
Find Reads Inside Loops
A database read inside a per-item loop often turns one request into
many serial round trips. lmprobe can collect the two evidence
streams an agent needs: read calls and loop ranges.
Synthetic vulnerable code
class ScheduleService {
List<Summary> build(List<Day> days) {
List<Summary> summaries = new ArrayList<>();
for (Day day : days) {
Summary summary = dailyRepository.findByDate(day);
summaries.add(summary);
}
return summaries;
}
}
The repository call is inside the loop. The usual fix is to
batch the read before the loop, then index the results in memory.
lmprobe evidence recipe
lmprobe --format json grep --parents \
'\w*(Repository|Service)\.(get|find|load|fetch|read|select)[A-Za-z]*\(' \
-G '**/src/main/java/**/*.java' .
lmprobe --format json grep --parents '\b(for|while)\s*\(' \
-G '**/src/main/java/**/*.java' .
lmprobe --format json search -p 'for ($T $V : $C) { $$$B }' \
-l java src/services/ScheduleService.java
Join the read-call line numbers to loop spans. A hit whose line
falls inside a loop span is a candidate N+1-by-iteration bug.
What the agent cites
{
"file_path": "src/services/ScheduleService.java",
"line_number": 6,
"line_content": "for (Day day : days) {",
"parents": [
{
"kind": "method_declaration",
"name": "build",
"line_start": 2,
"line_end": 11
}
]
}
{
"file_path": "src/services/ScheduleService.java",
"line_number": 7,
"line_content": "dailyRepository.findByDate(day);",
"parents": [
{
"kind": "method_declaration",
"name": "build",
"line_start": 2,
"line_end": 11
}
]
}
Case 2
Find Integer Narrowing Hazards
lmprobe can also search for suspicious casts around time, duration,
count, or identifier values, then return exact file and line
evidence for review.
Synthetic vulnerable code
long elapsedMillis = endMillis - startMillis;
short bucketCount = (short) (elapsedMillis / bucketMillis);
if (bucketCount > MAX_BUCKETS) {
return limit(bucketCount);
}
The cast may silently wrap a wider value. The safer pattern is to
keep the wide type, range-check, then convert only if valid.
lmprobe search
lmprobe --format json grep \
'\(short\)[^;]*([Tt]ime|[Dd]uration|[Cc]ount|[Mm]illis)' \
src
The output is structured, so an agent can rank candidates,
cite exact lines, and keep warnings separate from matches.
Agent workflow
Bug Hunts Need Repeatable Evidence
lmprobe is useful when the question is larger than one file:
collect candidate sites, keep parse warnings visible, cite exact
lines, then hand the result to a human or repair agent.
Scan
Use grep, search, and GraphQL composition to collect candidates.
Rank
Prefer candidates with loop containment, risky casts, repeated reads, or high fan-out.
Cite
Return the file path, line number, line content, schema, exit status, and warnings.
Fix
Use the evidence to plan a small patch, then verify the behavior with project tests.
Sanitization note: this page intentionally uses only
generic examples and synthetic paths. It does not reveal real
repositories, companies, products, endpoints, credentials, or source
code.