Ask natural-language queries (“where are auth tokens validated?”). Combine with ripgrep-style tools for exact strings.