[hellcow]

It seems feasible to use a small/cheap model to flag possible vulnerabilities, and then use a more expensive model to do a second-pass to confirm those, rather than on every file. Could dramatically reduce the total cost and speed up the process.

[conception]

Does it? I don’t see quality from small models being high enough to be able to effectively scour a code based like this.