Developers share ways to control quality of AI-written code
The original poster says Claude-generated features lack a shared behavior model, and commenters suggest tests, docs, and build-failing rules.
Stories per day · 30 days
6 RSS
Relatedsast5ai-agents2c-cpp2llm2primevul2semgrep2access-control1agent-skills1android1claude1clawhub1code-quality1code-recovery1ev-charging1false-evidence1false-positives1firmware1joern1
39 stories, newest first · one card per story
Stories tagged #static-analysis
SAST findings vary widely across 12 OCPP 1.6 language ports
SonarQube, Semgrep, and language-specific analyzers reported two issues in Rust and 1,689 in Java.
SecPatRec recovers security patterns from code
SecPatRec uses LLM agent with code search and static graphs to recover security pattern roles, grounding, and interactions from Java and Python repositories.
Callix Detects Access Control Flaws in Android Firmware
Callix found 819 vulnerable paths in 1,750 pre-installed Android apps.
Joern negative reachability misses executed Python functions
In asciinema, 113 of 123 functions Joern called unreachable from entry points still ran; Sublist3r executed 19 of 24.
VulnBench 2.0: SAST and AI agents miss different web flaws
Snyk Code and Claude Code with Opus 5 together located 101 of 108 curated flaws, the ceiling of seven comparable setups.
REVA screens new functions for vulnerabilities in about one second
On PrimeVul, REVA with GLM-5.3-Flash matches VulTriage accuracy while running over 250 times faster.
SCS finds 627 malicious agent skills in 66,157 ClawHub packages
On a balanced 234-skill benchmark it reached 85.6% accuracy, 95.2% recall and 86.9% F1.
LLM vulnerability auditors defer more to false assurances than false alarms
Across 16,572 audits of PrimeVul pairs, true static-analysis notes barely helped, while fabricated assurances cut real-bug detection by up to 19 points.
VulnSAGE checks LLM judgments of SAST reports against program structure
On 187 labeled reports it rejected 89 of 97 false alarms and kept 85 of 90 real defects.
Evaluating and Improving Static Application Security Testing Tools for Rust
Researchers evaluate Rust SAST tools and use LLM framework TRUST to uncover 46 faults.
Combining LLM and Dynamic Analysis for Universal Testing of Static Application Security Testing Tools
LLM4SAST finds 66 SAST-tool faults, with 32 confirmed or fixed by developers.
12 Best SAST Tools Compared (2026): Features & Pricing
A 2026 comparison ranks twelve SAST tools, with CodeQL, Snyk Code, and SonarQube leading their lanes.
MARS: Malware Analysis with Rule-Based Scoring of LLM Claims
MARS study finds direct LLM malware verdicts outperform externally scored behavioral claims.
Top 10 Best SAST Tools in 2026 [Ranked & Scored]
A 2026 editorial ranking puts Snyk Code first among ten SAST tools, ahead of CodeQL and Semgrep.
CheckerBench: Can Long-Horizon Agents Synthesize Static-Analysis Checkers?
CheckerBench measures whether coding agents can write working static-analysis checkers across 300 CVE-based tasks.
PrivDev: Mapping Static-Analysis Data Types to DPV
PrivDev maps 122 Bearer CLI static-analysis data types to DPV personal-data categories and GDPR provisions via deterministic matching plus an LLM.
Beyond Predefined Sinks: Security-Aware Dependency Analysis for LLM Agents
AgentSecGraph static analysis maps security-sensitive operations in LLM agent code across 67 repositories, surfacing one confirmed vulnerability and 23,866 candidates.
OWASP Noir: Open-source static analysis tool
OWASP Noir statically inventories API endpoints across 29 languages and 205 frameworks, surfacing shadow APIs and hardcoded secrets for reviewers and DAST tools.
From Source Code to Network Profile: Automated and Traceable MUD Profile Generation for IoT Devices
AutoMUD builds traceable IoT MUD network profiles from firmware and source code rather than traffic.
Code Security Review tool
Karma Pro, an open-source macOS scanner, reviews multi-language code with AST, heuristics, and an ML classifier.
TraceVIC: Causal Reasoning over Code Evolution for Identifying Vulnerability-Inducing Commits
TraceVIC ranks vulnerability-inducing commits by reasoning over how vulnerable code evolves across revisions.
Delphi Scanner: efficient and interpretable static malware detection via API sequence modeling
Researchers introduce Delphi Scanner, a 1.53 MB CNN-based static malware detector for Windows PE files using API sequences, achieving 95.35% accuracy.
CASHEWS: Source Preprocessor for LLM-based Malicious Package Detection
CASHEWS preprocessor boosts LLM-based malicious npm package detection, raising coverage to 98.8-100% and cutting false negatives by up to 18.6 points.