Sanitized bug-finding examples

Use code evidence to find real bug classes.

These examples are synthetic and fully sanitized. They are based on bug patterns that lmprobe can surface, but they do not include real proprietary code, product names, company names, repository paths, service endpoints, credentials, or customer data.

Evidence first
{
  "schema": "lmprobe.grep.v1",
  "exit_status": "matched",
  "hits": [
    {
      "file_path": "src/services/ScheduleService.java",
      "line_number": 7,
      "line_content": "dailyRepository.findByDate(day);"
    }
  ],
  "warnings": []
}

Case 1

Find Reads Inside Loops

A database read inside a per-item loop often turns one request into many serial round trips. lmprobe can collect the two evidence streams an agent needs: read calls and loop ranges.

Synthetic vulnerable code

class ScheduleService {
  List<Summary> build(List<Day> days) {
    List<Summary> summaries = new ArrayList<>();

    for (Day day : days) {
      Summary summary = dailyRepository.findByDate(day);
      summaries.add(summary);
    }

    return summaries;
  }
}

The repository call is inside the loop. The usual fix is to batch the read before the loop, then index the results in memory.

lmprobe evidence recipe

lmprobe --format json grep --parents \
  '\w*(Repository|Service)\.(get|find|load|fetch|read|select)[A-Za-z]*\(' \
  -G '**/src/main/java/**/*.java' .

lmprobe --format json grep --parents '\b(for|while)\s*\(' \
  -G '**/src/main/java/**/*.java' .

lmprobe --format json search -p 'for ($T $V : $C) { $$$B }' \
  -l java src/services/ScheduleService.java

Join the read-call line numbers to loop spans. A hit whose line falls inside a loop span is a candidate N+1-by-iteration bug.

What the agent cites

{
  "file_path": "src/services/ScheduleService.java",
  "line_number": 6,
  "line_content": "for (Day day : days) {",
  "parents": [
    {
      "kind": "method_declaration",
      "name": "build",
      "line_start": 2,
      "line_end": 11
    }
  ]
}
{
  "file_path": "src/services/ScheduleService.java",
  "line_number": 7,
  "line_content": "dailyRepository.findByDate(day);",
  "parents": [
    {
      "kind": "method_declaration",
      "name": "build",
      "line_start": 2,
      "line_end": 11
    }
  ]
}

Case 2

Find Integer Narrowing Hazards

lmprobe can also search for suspicious casts around time, duration, count, or identifier values, then return exact file and line evidence for review.

Synthetic vulnerable code

long elapsedMillis = endMillis - startMillis;
short bucketCount = (short) (elapsedMillis / bucketMillis);

if (bucketCount > MAX_BUCKETS) {
  return limit(bucketCount);
}

The cast may silently wrap a wider value. The safer pattern is to keep the wide type, range-check, then convert only if valid.

lmprobe search

lmprobe --format json grep \
  '\(short\)[^;]*([Tt]ime|[Dd]uration|[Cc]ount|[Mm]illis)' \
  src

The output is structured, so an agent can rank candidates, cite exact lines, and keep warnings separate from matches.

Agent workflow

Bug Hunts Need Repeatable Evidence

lmprobe is useful when the question is larger than one file: collect candidate sites, keep parse warnings visible, cite exact lines, then hand the result to a human or repair agent.

Scan Use grep, search, and GraphQL composition to collect candidates.
Rank Prefer candidates with loop containment, risky casts, repeated reads, or high fan-out.
Cite Return the file path, line number, line content, schema, exit status, and warnings.
Fix Use the evidence to plan a small patch, then verify the behavior with project tests.
Sanitization note: this page intentionally uses only generic examples and synthetic paths. It does not reveal real repositories, companies, products, endpoints, credentials, or source code.