Why SAST tools produce false positives
A tour of the static analysis landscape and the structural reasons every tool in it over-reports — from Rice's theorem down to the sanitiser it has never seen. Plus what actually reduces the noise.
Writing
Notes on reading code for vulnerabilities
Long-form writing on static analysis: what the tools find, what they miss, and why. Written by the people building the engine, using output from real scans rather than textbook examples.
The security risks of LLM-generated code
Models got dramatically better at writing code and barely better at writing secure code. Here is what the evidence says, which vulnerabilities assistants actually produce, and where the line around vibe coding really sits.