| Ghost Security CAST Report | Code Analysis | SAST and Code Analysis |
| DryRun - Beyond Pattern Matching | Code Analysis | SAST and Code Analysis |
| Semgrep - Finding Vulns with Claude and Codex | Code Analysis | SAST and Code Analysis |
| How to Scan for Vulnerabilities with GitHub Security Lab's Open Source AI-Powered Framework | Code Analysis | SAST and Code Analysis |
| 5 Types of Reachability Analysis and Which is Right for You | Code Analysis | SAST and Code Analysis |
| A Comparative Study of Vulnerability Reporting by Software Composition Analysis Tools | Code Analysis | SAST and Code Analysis |
| A Deeper Look at Modern SAST Tools - CodeQL vs Semgrep | Code Analysis | SAST and Code Analysis |
| AGHAST - AI Guided Hybrid Application Static Testing | Code Analysis | SAST and Code Analysis |
| AI Deep SAST - LLM-powered deep static analysis combining Semgrep and frontier models | Code Analysis | SAST and Code Analysis |
| Announcing OpenGrep - and the importance of a commoditized SAST | Code Analysis | SAST and Code Analysis |
| Announcing the Trail of Bits Testing Handbook | Code Analysis | SAST and Code Analysis |
| APKHunt - OWASP MASVS static analyzer for Android apps | Code Analysis | SAST and Code Analysis |
| AppSec guides, not gates: Introducing secure guardrails with Semgrep | Code Analysis | SAST and Code Analysis |
| AppThreat/atom - intermediate representation for supply-chain, vulnerability and reachability analysis | Code Analysis | SAST and Code Analysis |
| AstGrep MCP - structural code search as an MCP tool for agent code review | Code Analysis | SAST and Code Analysis |
| audit - 8-stage vulnerability-discovery agent built on the Claude Agent SDK | Code Analysis | SAST and Code Analysis |
| Awesome LLMs for Vulnerability Detection | Code Analysis | SAST and Code Analysis |
| Bridgecrew Azure Pipelines security policies | Code Analysis | SAST and Code Analysis |
| Claude Security public beta - AI codebase vulnerability scanning with validated findings and patches | Code Analysis | SAST and Code Analysis |
| CodeCrucible: A blueprint for LLM-driven SAST | Code Analysis | SAST and Code Analysis |
| CodeQL threat model settings for Java make code scanning more adaptable to your codebase | Code Analysis | SAST and Code Analysis |
| CodeQL updates from the first half of 2023 | Code Analysis | SAST and Code Analysis |
| CodeSheriff.NET - Roslyn-based security scanner for ASP.NET Core | Code Analysis | SAST and Code Analysis |
| Datadog acquires Codiga | Code Analysis | SAST and Code Analysis |
| Did Semgrep Just Get A Lot More Interesting | Code Analysis | SAST and Code Analysis |
| DryRun Security vs. Semgrep, SonarQube, CodeQL and Snyk - C# Security Analysis Showdown | Code Analysis | SAST and Code Analysis |
| Finding Vulnerabilities with MRVA CodeQL | Code Analysis | SAST and Code Analysis |
| Fixing security vulnerabilities with AI - GitHub code scanning autofix | Code Analysis | SAST and Code Analysis |
| Found means fixed: Secure code more than three times faster with Copilot Autofix | Code Analysis | SAST and Code Analysis |
| GitHub code scanning: customize CodeQL default setup at scale with a config file | Code Analysis | SAST and Code Analysis |
| globstar - open-source static analysis toolkit | Code Analysis | SAST and Code Analysis |
| How AI Code Scanning Breaks SAST's Limits - Corgea as an Example | Code Analysis | SAST and Code Analysis |
| How Semgrep Multimodal Finds the IDORs Other Tools Miss - benchmark vs Mythos | Code Analysis | SAST and Code Analysis |
| How we are self-hosting code scanning at Reddit - r/RedditEng | Code Analysis | SAST and Code Analysis |
| ICYMI: CodeQL enhancements | Code Analysis | SAST and Code Analysis |
| Important updates to Semgrep OSS - Semgrep Community Edition and LGPL licensing | Code Analysis | SAST and Code Analysis |
| Introducing AGHAST: AI-Guided Hybrid Application Static Testing | Code Analysis | SAST and Code Analysis |
| Introducing Antares: Highly Efficient Open Weight AI Models for Vulnerability Localization | Code Analysis | SAST and Code Analysis |
| Introducing deepsec: The security harness for finding vulnerabilities in your codebase | Code Analysis | SAST and Code Analysis |
| Java projects no longer require a build when using code scanning via default setup | Code Analysis | SAST and Code Analysis |
| Joern - the Bug Hunter's Workbench | Code Analysis | SAST and Code Analysis |
| jswzl - JavaScript static analysis for penetration testers and bug hunters | Code Analysis | SAST and Code Analysis |
| Kyle Kelly on Semgrep removing open-source metadata fields and the rise of Opengrep | Code Analysis | SAST and Code Analysis |
| LAST - Latio Application Security Tester, AI code scanning CLI | Code Analysis | SAST and Code Analysis |
| Learning CodeQL | Code Analysis | SAST and Code Analysis |
| LLM-Driven SAST-Genius: A Hybrid Static Analysis Framework for Comprehensive and Actionable Security | Code Analysis | SAST and Code Analysis |
| llm-sast-scanner - SAST skill for AI coding agents | Code Analysis | SAST and Code Analysis |
| Martin Torp on the Semgrep and Opengrep fork situation | Code Analysis | SAST and Code Analysis |
| MegaLinter - multi-language linter with security scanning for CI | Code Analysis | SAST and Code Analysis |
| Microsoft Azure Security expands variant hunting capacity at a cloud tempo | Code Analysis | SAST and Code Analysis |
| Modern Static Analysis: how the best tools empower creativity | Code Analysis | SAST and Code Analysis |
| Multi-repository variant analysis: a powerful new way to perform security research across GitHub | Code Analysis | SAST and Code Analysis |
| nano-analyzer - minimal LLM-powered zero-day vulnerability scanner by AISLE | Code Analysis | SAST and Code Analysis |
| octoscan - static vulnerability scanner for GitHub Actions workflows | Code Analysis | SAST and Code Analysis |
| open-kritt - self-hosted AI vulnerability research platform orchestrating agents | Code Analysis | SAST and Code Analysis |
| openai/codex-security - Codex Security CLI and SDK for finding, validating and fixing vulnerabilities | Code Analysis | SAST and Code Analysis |
| OpenCodeReview - Alibaba's hybrid deterministic plus LLM agent code review tool | Code Analysis | SAST and Code Analysis |
| Opengrep - open source SAST engine, fork of Semgrep | Code Analysis | SAST and Code Analysis |
| Opengrep - open-source code security engine, fork of Semgrep CE | Code Analysis | SAST and Code Analysis |
| opentaint - open source taint analysis engine built for AI agents, alternative to Semgrep Pro and CodeQL | Code Analysis | SAST and Code Analysis |
| OpenVuln - AI-powered open source vulnerability analysis | Code Analysis | SAST and Code Analysis |
| OWASP Noir - attack surface detector that finds endpoints via static analysis | Code Analysis | SAST and Code Analysis |
| OWASP Noir - hybrid static and AI-driven endpoint and attack surface analyzer | Code Analysis | SAST and Code Analysis |
| Peter Winter-Smith announces wSAST, a code analyser for application security consultants | Code Analysis | SAST and Code Analysis |
| railguard-skill - Netflix Skunkworks experiment in LLM-driven static security analysis | Code Analysis | SAST and Code Analysis |
| RepoAudit - autonomous LLM agent for repository-level code auditing | Code Analysis | SAST and Code Analysis |
| route-detect - find authentication and authorization bugs in web application routes | Code Analysis | SAST and Code Analysis |
| Rule Writing for CodeQL and Semgrep - Spaceraccoon | Code Analysis | SAST and Code Analysis |
| SAST Code Security Showdown, ChatGPT vs. Snyk Code - Latio | Code Analysis | SAST and Code Analysis |
| SAST Code Security Showdown, ChatGPT vs. Snyk Code - video summary | Code Analysis | SAST and Code Analysis |
| sec-af - AI-native code security auditor | Code Analysis | SAST and Code Analysis |
| Securing CodeQL queries with Semgrep | Code Analysis | SAST and Code Analysis |
| Semgrep for Terraform Security | Code Analysis | SAST and Code Analysis |
| Semgrep Guardian | Code Analysis | SAST and Code Analysis |
| semgrep-rules - 0xdea's Semgrep rules for vulnerability research | Code Analysis | SAST and Code Analysis |
| semgrep-rules-android-security - Semgrep rules derived from OWASP MASTG for Android apps | Code Analysis | SAST and Code Analysis |
| semgrep-server-rules - Semgrep rule server | Code Analysis | SAST and Code Analysis |
| Sighthound - open-source Rust static vulnerability scanner with taint analysis from Corgea | Code Analysis | SAST and Code Analysis |
| Sighthound - tree-sitter based static vulnerability scanner | Code Analysis | SAST and Code Analysis |
| Static Security Vulnerability Scanning of Proprietary and Open-Source Software: An Adaptable Process | Code Analysis | SAST and Code Analysis |
| Swival security-audits - reports from automated AI security audits of open source projects | Code Analysis | SAST and Code Analysis |
| tfrev - AI-powered Terraform plan reviewer catching security risks before apply | Code Analysis | SAST and Code Analysis |
| TheAuditor - queryable code intelligence and polyglot SAST platform for AI agents | Code Analysis | SAST and Code Analysis |
| Trailmark - Build and query a graph database of source code for security analysis | Code Analysis | SAST and Code Analysis |
| Trailmark turns code into graphs | Code Analysis | SAST and Code Analysis |
| Varun Badhwar on the launch of Opengrep, an open-source SAST fork of Semgrep | Code Analysis | SAST and Code Analysis |
| Velonus - AI-native security copilot that scans Python for secrets, vulns and dependency CVEs | Code Analysis | SAST and Code Analysis |
| Visa Vulnerability Agentic Harness - agentic SAST pipeline | Code Analysis | SAST and Code Analysis |
| vscode-security-notes - VSCode extension for security code review notes and SAST findings | Code Analysis | SAST and Code Analysis |
| VulnHunter - Capital One's agentic AI attacker-first source code security tool | Code Analysis | SAST and Code Analysis |
| VulnHunter - Capital One's open-source agentic AI code security tool | Code Analysis | SAST and Code Analysis |
| vulnhuntr - zero shot vulnerability discovery using LLMs and static code analysis | Code Analysis | SAST and Code Analysis |
| We Audited the Same Codebase with Claude Opus 4.8 and MiniMax M3 | Code Analysis | SAST and Code Analysis |
| We Put GPT-4 in Semgrep to Point Out False Positives and Fix Code | Code Analysis | SAST and Code Analysis |
| Whitepaper: BLAST, the AI-powered SAST scanner - Corgea | Code Analysis | SAST and Code Analysis |
| wSAST - static analysis security testing framework for code review | Code Analysis | SAST and Code Analysis |
| Xpsd - LLM-driven reachability triage for vulnerability scan findings | Code Analysis | SAST and Code Analysis |
| AISLE | Code Analysis | Platforms |
| DepthFirst | Code Analysis | Platforms |
| ZeroPath | Code Analysis | Platforms |
| Announcing general availability of GitHub Advanced Security for Azure DevOps | Code Analysis | Platforms |
| Application security orchestration with GitHub Advanced Security | Code Analysis | Platforms |
| CodeRabbit - AI code review platform | Code Analysis | Platforms |
| Corgea - AI application security platform that finds, triages and fixes vulnerabilities | Code Analysis | Platforms |
| Cycode - GitHub Advanced Security alternative for software supply chain security | Code Analysis | Platforms |
| Cycode Acquires Bearer to Deliver AI-Powered SAST and API Discovery | Code Analysis | Platforms |
| DryRun Security Q1 2026: Everything We Shipped and Why It Matters | Code Analysis | Platforms |
| GitHub code scanning adds a mitigated alert dismissal reason | Code Analysis | Platforms |
| Introducing the Mend AppSec Platform | Code Analysis | Platforms |
| Launch HN: Corgea - Auto fix vulnerable code | Code Analysis | Platforms |
| Legit Security Launches VibeGuard 2.0 - securing AI-generated code | Code Analysis | Platforms |
| Pi - agentic product security platform | Code Analysis | Platforms |
| Pixee - Agentic AppSec platform to triage and fix vulnerabilities | Code Analysis | Platforms |
| SecHub - central API to orchestrate security scanning tools, archived | Code Analysis | Platforms |
| Semgrep Managed Scans | Code Analysis | Platforms |
| Snyk Studio - Secure at Inception code scanning for AI coding assistants via the Snyk MCP Server | Code Analysis | Platforms |
| The Firewall - open source shift-left AppSec platform for secrets scanning and SCA | Code Analysis | Platforms |
| winfunc - AI security agents that find, triage, and patch codebase vulnerabilities | Code Analysis | Platforms |
| ZeroPath - AI code security platform changelog | Code Analysis | Platforms |
| New in Corgea: Container Scanning + IaC Scanning - Corgea | Code Analysis | Security Tools and Analysis |
| How to Kill the Code Review | Code Analysis | Security Tools and Analysis |
| New Feature: Corgea Agent - Corgea | Code Analysis | Security Tools and Analysis |
| New Product: Code Quality - Corgea | Code Analysis | Security Tools and Analysis |
| Enable external threat detection and protection for Copilot Studio | Code Analysis | Security Tools and Analysis |
| About GitHub Copilot coding agent - GitHub Enterprise Cloud Docs | Code Analysis | Security Tools and Analysis |
| Apiiro AI-SAST: Static Scanning Reimagined – From Code to Runtime | Code Analysis | Security Tools and Analysis |
| Vulnhalla: Picking the true vulnerabilities from the CodeQL haystack | Code Analysis | Security Tools and Analysis |
| IDEsaster: A Novel Vulnerability Class in AI IDEs | Code Analysis | Security Tools and Analysis |
| WildCode: An Empirical Analysis of Code Generated by ChatGPT | Code Analysis | Security Tools and Analysis |
| New public preview features in Copilot code review: AI reviews that | Code Analysis | Security Tools and Analysis |
| Introducing Corgea Dependency Scanning - Corgea | Code Analysis | Security Tools and Analysis |
| we now do [#curl | Code Analysis | Security Tools and Analysis |
| AI and Secure Code Learning: An Empirical Analysis of 420 AI-Genera | Code Analysis | Security Tools and Analysis |
| Constructing a Trustworthy Evaluation Methodology for Contextual Se | Code Analysis | Security Tools and Analysis |
| AI Native LLM Security: A comprehensive guide to leveraging OWASP T | Code Analysis | Security Tools and Analysis |
| SAST Accuracy Report | Code Analysis | Security Tools and Analysis |
| SAIL Framework: A Practical Guide for AI Security | Code Analysis | Security Tools and Analysis |
| Copy of OWASP LLM_GenAI Security Solutions Reference Guide Q2'25 3/ | Code Analysis | Security Tools and Analysis |
| Free AI code reviews for VS Code - Code Reviews | Code Analysis | Security Tools and Analysis |
| One Year of Using LLMs for Application Security: What We Learned | Code Analysis | Security Tools and Analysis |
| Automate code reviews, patching a | Code Analysis | Security Tools and Analysis |
| 10x your AppSec program with Semgrep Assistant | Code Analysis | Security Tools and Analysis |
| Security Code Review With ChatGPT | Code Analysis | Security Tools and Analysis |
| Securing our codebase with autonomous agents | Code Analysis | Security Tools and Analysis |
| State of AI code quality | Code Analysis | Security Tools and Analysis |
| Notes: AI Copilot Code Quality · Technical Ramblings | Code Analysis | Security Tools and Analysis |
| 42Crunch API Security Testing plugin for Claude Code | Code Analysis | Security Tools and Analysis |
| AISLE Discovers 38 CVEs in Healthcare Software Used by 100,000 Medical Providers | Code Analysis | Security Tools and Analysis |
| Attacking browser extensions - GitHub Security Lab | Code Analysis | Security Tools and Analysis |
| CLM-Forge - PowerShell WDAC script enforcement and Constrained Language Mode readiness toolkit | Code Analysis | Security Tools and Analysis |
| Daniel Stenberg on Joshua Rogers' AI-assisted bug findings in curl - 22 fixes landed already | Code Analysis | Security Tools and Analysis |
| defending-code-reference-harness - Anthropic autonomous vulnerability discovery and patching harness | Code Analysis | Security Tools and Analysis |
| diffalayze - LLM-assisted automated binary patch diffing and security analysis | Code Analysis | Security Tools and Analysis |
| Dohyun Lee on an LLM finding a Linux library vuln, writing a PoC and variant Firefox CVEs | Code Analysis | Security Tools and Analysis |
| FlowMate - BurpSuite extension for web application taint analysis | Code Analysis | Security Tools and Analysis |
| From finding to fixing: GitHub Advanced Security integrates Endor Labs SCA | Code Analysis | Security Tools and Analysis |
| Gadi Evron on an LLM-based, language-agnostic vulnerability variant hunter presented at BlueHat IL | Code Analysis | Security Tools and Analysis |
| GhidrAssist - LLM-powered reverse engineering assistant for Ghidra | Code Analysis | Security Tools and Analysis |
| GitHub security campaigns and assignable alerts for code scanning and secret scanning | Code Analysis | Security Tools and Analysis |
| grep.app - code search across a million GitHub repositories | Code Analysis | Security Tools and Analysis |
| hermes-dec - decompiler and disassembler for React Native Hermes bytecode | Code Analysis | Security Tools and Analysis |
| How Aikido finds more vulnerabilities than Claude Security with Mythos at half the cost | Code Analysis | Security Tools and Analysis |
| Introducing AI-powered application security testing with GitHub Advanced Security | Code Analysis | Security Tools and Analysis |
| Is runtime SCA reachability a gimmick? A look at Oligo Security - Latio | Code Analysis | Security Tools and Analysis |
| LVRP - local LLM-driven vulnerability research pipeline | Code Analysis | Security Tools and Analysis |
| MAD Bugs: All Your Reverse Engineering Tools Are Belong to US - AI-found RCEs in Ghidra, radare2, IDA, Binary Ninja | Code Analysis | Security Tools and Analysis |
| Master fuzzing with our new Testing Handbook chapter - Trail of Bits | Code Analysis | Security Tools and Analysis |
| Mav Levin on AI security agents finding and patching RCE CVE-2025-59304 in Swetrix | Code Analysis | Security Tools and Analysis |
| Mobb - AI-powered vulnerability remediation | Code Analysis | Security Tools and Analysis |
| Monocle - LLM-backed natural language search over compiled binaries | Code Analysis | Security Tools and Analysis |
| Ocular - Kubernetes-native security scanning orchestration for software assets | Code Analysis | Security Tools and Analysis |
| oss-fuzz-gen - LLM-powered fuzzing via OSS-Fuzz | Code Analysis | Security Tools and Analysis |
| OVRSE - Open Vulnerability Remediation Specification engine for AI-driven vulnerability fixing | Code Analysis | Security Tools and Analysis |
| OWASP Noir - hunt every endpoint in your code, expose shadow APIs, map the attack surface | Code Analysis | Security Tools and Analysis |
| PatchDiff-AI - LLM CVE binary-diff root-cause analysis | Code Analysis | Security Tools and Analysis |
| Rate My OpenAPI - find API quality and security issues via OpenAPI spec | Code Analysis | Security Tools and Analysis |
| Review every MR for $0.25 - GitLab Duo Code Review | Code Analysis | Security Tools and Analysis |
| Schemathesis - property-based API testing and fuzzing for OpenAPI and GraphQL | Code Analysis | Security Tools and Analysis |
| Securing your Codebase - learning DevSecOps and a security-first approach for Feluda, part 1 | Code Analysis | Security Tools and Analysis |
| Slice: SAST + LLM Interprocedural Context Extractor | Code Analysis | Security Tools and Analysis |
| Specula - agentic bug finding in system code using TLA+ | Code Analysis | Security Tools and Analysis |
| The Cheapest Token Is The One You Never Spend | Code Analysis | Security Tools and Analysis |
| The Diminishing Returns of DAST - Boring AppSec Edition 18 | Code Analysis | Security Tools and Analysis |
| trace37 on tuning Claude Code skills to autonomously hunt bugs with taint tracing | Code Analysis | Security Tools and Analysis |
| Trail of Bits open-sources Trailmark to give Claude call graphs of source code for security analysis | Code Analysis | Security Tools and Analysis |
| watchtower - Dependabot vulnerability SLA dashboard and merge gate | Code Analysis | Security Tools and Analysis |