# research-practice Published articles for research-practice. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## gosentry brings LibAFL-grade fuzzing to Go's native interface DevFeed: [gosentry brings LibAFL-grade fuzzing to Go's native interface]() Original publisher: [Read original article]() Author: "Kevin Valerio" Published: 2026-05-12T11:00:00Z Content type: article Language: en Sources: [The Trail of Bits Blog](), [The Trail of Bits Blog]() Topics: [Go Language](), [C++]() Tags: [bug](), [c](), [c-plus-plus](), [cache](), [cli](), [fuzzing](), [go](), [research-practice](), [rust](), [security](), [testing](), [tool-release](), [toolchain](), [tooling](), [vulnerabilities](), [workflow]() ### AI overview Gosentry is a fuzzing-oriented fork of the Go toolchain that retains Go's native fuzzing interface while using LibAFL by default. It adds native struct fuzzing, Nautilus grammar-based fuzzing, additional bug detection, and campaign coverage reporting without requiring existing Go fuzz harnesses to be rewritten. ### Source excerpt Go's native fuzzing is useful, but it stands far behind state-of-the-art tooling that the Rust, C, and C++ ecosystems offer with LibAFL and AFL++. Path constraints are hard to solve. Structured inputs usually need handmade parsing. It doesn't even detect several common bug classes, such as integer overflows, goroutine leaks, data races, and execution timeouts. So to make it better, we built gosentry, a fuzzing-oriented fork of the Go toolchain that keeps the standard testing.F workflow while using a stronger fuzzing stack underneath to tackle those issues. With gosentry, go test -fuzz uses LibAFL by default. It can fuzz structs natively, run grammar-based fuzzing with Nautilus, detect bug classes that it couldn't detect before, and create a fuzzing campaign coverage report in one command. If you already have Go fuzz harnesses, you don't need to rewrite them. Point them at gosentry's binary and you get all of the above through the same go test -fuzz interface, with a few new flags: ./bin/go test -fuzz=FuzzHarness --focus-on-new-code=false --catch-races=true --catch-leaks=true Figure 1: Basic gosentry usage gosentry keeps the harness API and changes the engine and the surrounding tooling -- you just tweak the CLI. You can also generate coverage reports from an existing campaign with --generate-coverage. Run it from the same package with the same -fuzz target, and no corpus path is needed; gosentry stores the campaign state under Go's fuzz cache index by package and fuzz target, so restarting the campaign resumes from the existing corpus. Why we built gosentry We started this project after we released go-panikint to improve Go fuzzing's integer overflow detection. We realized that integer overflow detection wasn't enough. Go's fuzzing ecosystem was still missing techniques that Rust, C, and C++ researchers already use every day. We often faced these gaps in our own security work using Go's vanilla fuzzer: Program comparisons (path constraints) were impossible to solve: ## Trailmark turns code into graphs DevFeed: [Trailmark turns code into graphs]() Original publisher: [Read original article]() Author: "Scott Arciszewski" Published: 2026-04-23T12:00:00Z Content type: article Language: en Sources: [The Trail of Bits Blog](), [The Trail of Bits Blog]() Topics: [Graphs](), [mutation-testing](), [Claude](), [Code](), [Claude Code](), [test-coverage](), [Tree-sitter](), [Python]() Tags: [ai](), [claude](), [claude-code](), [code](), [graphs](), [mutation-testing](), [open-source](), [python](), [research-practice](), [software](), [testing](), [tool](), [tool-release]() ### AI overview Trailmark is an open-source library that parses source code into queryable call graphs and exposes them through a Python API that Claude skills can call. The article explains how graph-level reasoning can help analyze codebases, triage surviving mutation-testing mutants by security relevance, and support Claude Code skills for tasks such as test vector generation and protocol diagramming. ### Source excerpt We're open-sourcing Trailmark, a library that parses source code into a queryable call graph of functions, classes, call relationships, and semantic metadata, then exposes that graph through a Python API that Claude skills can call directly. Install it now: uv pip install trailmark "Defenders think in lists. Attackers think in graphs. As long as this is true, attackers win." John Lambert's widely cited observation about network security applies just as well to AI-assisted software analysis. When Claude reasons about a codebase, it reasons about lists: findings from static analyzers, surviving mutants from mutation testing, and line-by-line coverage reports. But the question that actually matters is a graph question: can untrusted input reach this code, and what breaks if it's wrong? We built Trailmark to answer that question. It gives Claude a graph to think with instead of a list. We're also releasing eight Claude Code skills we've built on top of it, designed for mutation triage, test vector generation, protocol diagramming, and more. When lists fall short Mutation testing is a great example of a method that benefits from graph-level reasoning. It's one of the best ways to measure test quality. It makes small changes to your source code (e.g., swapping a < for <=, replacing + with -) and checks whether your tests catch the difference. Mutants that survive reveal gaps in your test suite that code coverage metrics might miss. The downside is that a mutation testing run on a real codebase can produce hundreds of surviving mutants of varying significance. This is very much a list. Some surviving mutants are equivalent: the mutation doesn't change the program's behavior because of structural or mathematical constraints that the mutation testing tool can't see. Some are in dead code; some are in error message formatting; some are in the finite field arithmetic that underpins every cryptographic operation in your library. A flat list of surviving mutants doesn't tell you