# fold Expansion Roadmap — Security + Performance + Utility

> Generated 2026-05-29. Synthesized from 4 gap matrices + performance audit.

## Sprint 1 — Quick Wins (~2 weeks, 4 detectors)

| Priority | Detector | Type | Lines | Impact |
|----------|----------|------|-------|--------|
| 1 | Deprecated API (gets, strcpy, sprintf) | Syntactic | ~80 | Catches CWE-120/676 |
| 2 | Weak crypto (MD5, SHA1, DES) | Syntactic | ~60 | Replaces Semgrep rule |
| 3 | Format string (non-literal printf fmt) | Syntactic | ~50 | Catches CWE-134 |
| 4 | Hardcoded credential patterns | Syntactic | ~40 | Catches CWE-798 |

## Sprint 2 — Z3-Powered (~3 weeks, 3 detectors)

| Priority | Detector | Type | Lines | Impact |
|----------|----------|------|-------|--------|
| 5 | Use-after-move | Z3 (path) | ~150 | Catches C++ move semantics bugs |
| 6 | Iterator invalidation | Z3 (path) | ~200 | Catches container mutation bugs |
| 7 | SQL injection taint | Z3 (taint) | ~200 | Requires interprocedural taint |

## Sprint 3 — Performance (~2 weeks)

| Priority | Optimization | Expected Speedup |
|----------|-------------|-----------------|
| 1 | Bitwuzla multi-solver (--solver bitwuzla) | 2-5x on BV queries |
| 2 | TU pre-filter (skip files with no security ops) | 30% fewer TUs processed |
| 3 | Clone detector incremental (hash cache) | 50% clone time reduction |
| 4 | Parallel Z3 per-function (already partially done) | Linear speedup with cores |

## Sprint 4 — Utility & Integration (~2 weeks)

| Priority | Feature | Impact |
|----------|---------|--------|
| 1 | `fold --watch` mode (re-scan on file changes) | Developer workflow |
| 2 | Pre-commit hook integration (.git/hooks/pre-commit) | CI/CD |
| 3 | SARIF output formatting for GitHub Code Scanning | GitHub integration |
| 4 | IDE diagnostics (existing LSP, improve FindingKind mapping) | IDE integration |

## Long-Term Architecture

| Milestone | Description | Effort |
|-----------|-------------|--------|
| M13 | Full interprocedural analysis (cross-function Z3 proofs) | L |
| M12 | PDG/data-flow precision (prerequisite for M13) | L |
| M14 | SV-COMP/Juliet at scale (standardized benchmark) | L |
| Strategic | Bitwuzla as default solver (replaces Z3 for BV) | M |
| Strategic | Declarative detector DSL (10x detector authoring speed) | XL |

## What NOT to Prioritize

| Feature | Why Not |
|---------|--------|
| Concurrency detectors (RacerD-equivalent) | Requires thread interleaving model — beyond fold's scope |
| Whole-program taint tracking | Already have per-TU taint; cross-TU is M13 territory |
| Custom Semgrep rule import | Better to run OpenGrep alongside fold |
| LLM-based detectors | Research area, not production-ready |
| DAST integration (ZAP, Burp) | Binary-only fuzzing is fold's niche |