{"id":220,"date":"2026-01-16T02:38:42","date_gmt":"2026-01-16T02:38:42","guid":{"rendered":"https:\/\/jasveermaan.com\/?p=220"},"modified":"2026-03-13T10:06:26","modified_gmt":"2026-03-13T10:06:26","slug":"llm-assisted-source-code-review-using-falconeye","status":"publish","type":"post","link":"https:\/\/jasveermaan.com\/index.php\/2026\/01\/16\/llm-assisted-source-code-review-using-falconeye\/","title":{"rendered":"LLM Assisted Source Code Review Using FalconEye"},"content":{"rendered":"\n<p>Recently, my colleague was tasked with performing a source code review on a relatively large codebase. Given the size of the project, I started exploring whether a locally hosted LLM could be used to assist with the review, together with manual analysis.<\/p>\n\n\n\n<p>The key requirement was that everything must run locally. The source code contains sensitive information and cannot be uploaded to any cloud based service.<\/p>\n\n\n\n<p>Initially, I considered using Ollama to host an LLM locally to interact with the model by manually uploading code snippets. This approach ensures that all processing remains on the local machine. While exploring this further, I came across a tool called <a href=\"https:\/\/github.com\/FalconEYE-ai\/FalconEYE\">FalconEye<\/a>, which is designed specifically for LLM assisted source code review.<\/p>\n\n\n\n<p>This post documents the setup, usage, and initial findings of <a href=\"https:\/\/github.com\/FalconEYE-ai\/FalconEYE\">FalconEye<\/a>. The goal is to evaluate how useful LLM assisted analysis can be when combined with traditional manual source code review.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Why FalconEye?<\/h2>\n\n\n\n<p>FalconEye combines several components that are commonly used in modern LLM based analysis workflows.<\/p>\n\n\n\n<p>Key reasons for using <a href=\"https:\/\/github.com\/FalconEYE-ai\/FalconEYE\">FalconEye<\/a> include:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>No Pattern Matching: Uses pure AI reasoning to understand your code semantically<\/li>\n\n\n\n<li>Context-Aware Analysis: Retrieval-Augmented Generation provides relevant code context for deeper insights<\/li>\n\n\n\n<li>Novel Vulnerability Detection: Identifies security issues that don&#8217;t match known patterns<\/li>\n\n\n\n<li>Reduced False Positives: AI validation reduces noise from pattern-based false alarms<\/li>\n\n\n\n<li>Rich HTML Reports: Auto-generated interactive reports with executive dashboards and statistics<\/li>\n\n\n\n<li>Smart &amp; Fast: Incremental analysis means re-scans only process changed files<\/li>\n\n\n\n<li>Privacy-First: Runs entirely locally with Ollama\u2014your code never leaves your machine<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">Installation<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Step 1: Install Ollama and Required Models<\/h3>\n\n\n\n<p>FalconEye relies on Ollama to run LLMs locally. Once Ollama has been installed and is running, execute the following commands to download the required models.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">ollama pull qwen3-coder:30b<br>ollama pull embeddinggemma:300m<\/pre>\n\n\n\n<p>The purpose of each model is as follows<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>qwen3 coder is a large code focused LLM used to analyse source code and identify potential security issues<\/li>\n\n\n\n<li>embeddinggemma is used to generate embeddings for indexing and semantic search<\/li>\n<\/ul>\n\n\n\n<blockquote class=\"wp-block-quote has-small-font-size is-layout-flow wp-block-quote-is-layout-flow\">\n<p>Note that the download process may take some time depending on system performance.<\/p>\n<\/blockquote>\n\n\n\n<h3 class=\"wp-block-heading\">Step 2: Create a Python Virtual Environment<\/h3>\n\n\n\n<p>Using a virtual environment ensures that FalconEye does not affect other tools on the system.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">python3.12 -m venv .\/FalconEye<\/pre>\n\n\n\n<p>Activate the virtual environment using the following command.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">source .\/FalconEye\/bin\/activate<\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Step 3: Clone the FalconEye Repository<\/h3>\n\n\n\n<p>Once the virtual environment is active, clone the FalconEye repository from GitHub.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">git clone https:\/\/github.com\/FalconEYE-ai\/FalconEYE.git<br>cd FalconEYE<\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Step 4: Install FalconEye<\/h3>\n\n\n\n<p>Install FalconEye using the following command.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">pip install -e .<\/pre>\n\n\n\n<p>At this stage, the FalconEye command line tool should be available. The figure below shows FalconEye being installed successfully.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1912\" height=\"695\" src=\"https:\/\/jasveermaan.com\/wp-content\/uploads\/2026\/01\/FalconEye-Installing.png\" alt=\"\" class=\"wp-image-221\"\/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">Scanning the Code<\/h2>\n\n\n\n<h3 class=\"wp-block-heading\">Indexing the Codebase<\/h3>\n\n\n\n<p>Before performing any analysis, the codebase must be indexed. This step converts the source code into embeddings that will later be used for retrieval.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">falconeye index ~\/Desktop\/vuln-scan-demo<\/pre>\n\n\n\n<p>Once indexing is completed, FalconEye displays a summary including<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Number of indexed files<\/li>\n\n\n\n<li>Detected programming language<\/li>\n\n\n\n<li>Total lines of code<\/li>\n<\/ul>\n\n\n\n<p>The figure below shows indexing completed successfully.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"715\" height=\"399\" src=\"https:\/\/jasveermaan.com\/wp-content\/uploads\/2026\/01\/Index.png\" alt=\"\" class=\"wp-image-227\"\/><\/figure>\n\n\n\n<h3 class=\"wp-block-heading\">Running the Security Review<\/h3>\n\n\n\n<p>After indexing, the security review can be performed using the following command.<\/p>\n\n\n\n<pre class=\"wp-block-preformatted\">falconeye review ~\/Desktop\/vuln-scan-demo<\/pre>\n\n\n\n<p>At this point, FalconEye analyses the indexed codebase and reports potential security issues.<\/p>\n\n\n\n<p>The figure below shows that multiple vulnerabilities have been flagged by FalconEye.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1910\" height=\"352\" src=\"https:\/\/jasveermaan.com\/wp-content\/uploads\/2026\/01\/Vuln1.png\" alt=\"\" class=\"wp-image-231\"\/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1908\" height=\"380\" src=\"https:\/\/jasveermaan.com\/wp-content\/uploads\/2026\/01\/Vuln2.png\" alt=\"\" class=\"wp-image-232\"\/><\/figure>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1910\" height=\"341\" src=\"https:\/\/jasveermaan.com\/wp-content\/uploads\/2026\/01\/Vuln3.png\" alt=\"\" class=\"wp-image-233\"\/><\/figure>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"has-small-font-size\">Note: FalconEye also generates a report. The above screenshots were taken during the scanning stage.<\/p>\n<\/blockquote>\n\n\n\n<h3 class=\"wp-block-heading\">Analysing the Findings<\/h3>\n\n\n\n<p>From the results, FalconEye successfully identified several high risk issues including:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Command injection vulnerabilities caused by unsanitised user input<\/li>\n\n\n\n<li>SQL injection vulnerabilities due to unsafe string concatenation<\/li>\n\n\n\n<li>Hardcoded credentials in the source code<\/li>\n<\/ul>\n\n\n\n<p>These findings are consistent with what would typically be identified during a manual source code review. The figure below shows a snippet of the source code that confirms the application is vulnerable.<\/p>\n\n\n\n<p>User supplied input is passed directly into system level commands:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1328\" height=\"460\" src=\"https:\/\/jasveermaan.com\/wp-content\/uploads\/2026\/01\/Code1.png\" alt=\"\" class=\"wp-image-228\"\/><\/figure>\n\n\n\n<p>SQL queries are constructed using unvalidated input:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1442\" height=\"280\" src=\"https:\/\/jasveermaan.com\/wp-content\/uploads\/2026\/01\/Code2.png\" alt=\"\" class=\"wp-image-229\"\/><\/figure>\n\n\n\n<p>Authentication credentials are hardcoded in the source code:<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"870\" height=\"394\" src=\"https:\/\/jasveermaan.com\/wp-content\/uploads\/2026\/01\/Code3.png\" alt=\"\" class=\"wp-image-230\"\/><\/figure>\n\n\n\n<p>This confirms that FalconEye was able to correctly reason about security risks rather than simply matching patterns. Additionally, when my colleague used the tool during the assessment, it successfully identified the majority of the vulnerabilities, which was highly impressive.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Key Takeaways<\/h2>\n\n\n\n<p>Based on this initial assessment, FalconEye demonstrates the following strengths<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Provides meaningful context around why the code is vulnerable<\/li>\n\n\n\n<li>Works well as a prioritisation and review assistance tool<\/li>\n\n\n\n<li>Performs analysis fully offline which is critical for client engagements<\/li>\n<\/ul>\n\n\n\n<p>That said, FalconEye should not be treated as a replacement for manual source code review. Human validation is still required to confirm exploitability, assess business impact, and eliminate false positives.<\/p>\n\n\n\n<p class=\"has-small-font-size\">DIsclaimer: FalconEye was run against a demo application that was created purely for this blog. Results against real world applications may vary depending on code quality, framework usage, and application complexity.<\/p>\n\n\n\n<p><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Recently, my colleague was tasked with performing a source code review on a relatively large codebase. Given the size of the project, I started exploring whether a locally hosted LLM could be used to assist with the review, together with manual analysis. The key requirement was that everything must run locally. The source code contains &hellip; <\/p>\n<p class=\"link-more\"><a href=\"https:\/\/jasveermaan.com\/index.php\/2026\/01\/16\/llm-assisted-source-code-review-using-falconeye\/\" class=\"more-link\">Continue reading<span class=\"screen-reader-text\"> &#8220;LLM Assisted Source Code Review Using FalconEye&#8221;<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-220","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/jasveermaan.com\/index.php\/wp-json\/wp\/v2\/posts\/220","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/jasveermaan.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/jasveermaan.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/jasveermaan.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/jasveermaan.com\/index.php\/wp-json\/wp\/v2\/comments?post=220"}],"version-history":[{"count":6,"href":"https:\/\/jasveermaan.com\/index.php\/wp-json\/wp\/v2\/posts\/220\/revisions"}],"predecessor-version":[{"id":239,"href":"https:\/\/jasveermaan.com\/index.php\/wp-json\/wp\/v2\/posts\/220\/revisions\/239"}],"wp:attachment":[{"href":"https:\/\/jasveermaan.com\/index.php\/wp-json\/wp\/v2\/media?parent=220"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/jasveermaan.com\/index.php\/wp-json\/wp\/v2\/categories?post=220"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/jasveermaan.com\/index.php\/wp-json\/wp\/v2\/tags?post=220"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}