Home

16 Eyes — Wiki

Technical documentation for how 16 Eyes actually finds and verifies security findings. The README covers install/use; this wiki goes deeper into the methodology, for anyone deciding whether to trust the tool's output.

Pages

• Testing Methodology — the actual pipeline: lens investigation → skeptical verification → adversarial review → classification. The guards that keep a false positive or a corrupted model response out of the report.
• Vulnerability Coverage Map — the categories 16 Eyes' lens design typically considers, cross-referenced against the OWASP Top 10:2025 as a shared vocabulary — not a fixed checklist it runs in order.
• Full-repo vs Diff Audits — why /16-eyes audit and /16-eyes audit-diff both exist, how diff scope is detected, and which one to run where (CI vs. occasional deep sweep).
• Limitations & Honest Caveats — what this tool doesn't do, where its guarantees are weaker (non–Claude Code adapters), and what it isn't a substitute for.

The one-sentence version

Every finding goes through multiple independent model calls before it reaches a report: the lens that found it, a skeptical verifier that re-reads the real code, and — for high-impact findings — several adversarial reviewers actively trying to disprove it. Nothing survives on one agent's word alone. That's the "16 eyes" in the name (the four-eyes principle, scaled up), not a literal count of lenses — the actual number of lenses varies per repo, typically 6–20+.