3 ms·
I'd never considered semantic search for code vulnerabilities. Maybe this is the next generation of automated code scanning. Next feature on github: "Our LLM
by TOMDM 4y ago
I'd never considered semantic search for code vulnerabilities.
Maybe this is the next generation of automated code scanning.
Next feature on github: "Our LLM has scanned your code and found a potential buffer overflow. Please mark as a bug or a false report"
- popinman322 4y agoI know there's some active work on this (using LLMs, not traditional methods), not on the binary side but on the source analysis side. See https://grit.io/ https://grit.io/, which tries to detect bugs (and maybe vulnerabilities?) and automatically submits PRs to patch them for you. I think morgante is their contact on HN. It feels like it'd be difficult to acquire a large corpus of vulnerabilities to train on.
- ta988 4y agoThere are already systems for that in github enterprise. It works decently if you can massage your build to fit in their system. It is still more or less experimental for some languages.
- comon 4y agoSemmle (now GitHub CodeQL) ShiftLeft Oversecured etc. There are a few companies doing this.