Ugh. Someone did a 'Claude code audit' of a library I maintain. Of their top-ten highest priority fixes:
One is a real issue, but it's present in multiple functions in the file they looked at and they only found it in one.
One is a simple copy-and-paste bug, but is code that is basically dead on most platforms.
One is a real bug, but in some code that is basically unreachable (requires a called library to return the kind of failure you only get if everything is broken).
Two are issues that are only reachable with API misuse, one recommends adding an unnecessary check on one of the hottest code paths in the library.
Two are spurious issues.
One is complaining about using __sync builtins. This code predates C11 atomics. Yes, we should use them eventually.
One recommends a refactoring that was planned, but it's not urgent because it doesn't show up as a perf issue outside microbenchmarks.
One is recommending inverting a design choice that was made after implementing the thing that it proposed, measuring it, and then reverting it because it's much slower than the current design.
Such a waste of compute and time. Of the top ten issues, only one is actually important to fix and the proposed fix is incomplete.