» Tag
static-analysis
25 postsClaude Code Review Token Bills Cut 8-49x With Tree-sitter Call Graphs
A Tree-sitter call-graph blast-radius technique cuts Claude Code review token bills 8-49x, plus three traps that can silently erase the savings.
Rethinking MCP Security: A Large-Scale Study of 64K Runtime Servers
MCPZoo tests 64,611 MCP servers, revealing that most security scanner alerts are false positives and scanners disagree widely.
Rust Moves Toward Stabilizing Polonius Alpha Borrow Checker
Rust's Polonius alpha borrow checker nears stabilization, fixing NLL limitations with new tests, a formal model, and performance validation.
CommitBrief — AI code reviews, right in your terminal
A provider-agnostic, local-first CLI that reviews your staged changes, a historic range, or a whole GitHub pull request. Zero telemetry, no server. Free and open source.
commitbrief.comCodeCrucible: A Reusable Blueprint for LLM-Driven SAST
Block's CodeCrucible offers a reusable design blueprint for LLM-driven SAST, using whole-repo analysis instead of snippet-anchored vulnerability scanning.
Static Scanner Finds 30 Unguarded Destructive Actions in AI Agent Frameworks
An open-source scanner analyzed 25 AI agent frameworks and confirmed 30 cases where models can delete data, deploy, or send webhooks unauthorized.
Droidsaw: A Rust Tool for Byte-Perfect Android DEX/Hermes RE
Droidsaw is a Rust-based Android reverse engineering tool that reconstructs DEX and Hermes files byte-for-byte, with built-in security auditing.
Synapse Lets AI Flag False Positives, Never Delete Findings
Synapse's two-model AI triage flags false positives in security scans without deleting findings, preserving gate reliability and audit trails.
Epistemic Engine verifies AI code and predicts what will break
Epistemic Engine is an open-source Python tool that verifies AI-generated code and forecasts future failures using deterministic git-history analysis.
voidguard: A Static Scanner That Catches Tests That Verify Nothing
voidguard is an open-source static scanner that flags tests, type checks, and CI conditions that pass while verifying nothing.
GitHub Copilot Now Catches Vulnerabilities Before You Commit
GitHub Copilot's new slash command scans uncommitted code for OWASP vulnerabilities like injection and XSS before it ever reaches your repo.