Viewing profile — asadeddin

We're open-sourcing Sighthound today, our rules-based static security scanner. What makes it special is that it's coded in rust and uses tree-sitter as it's AST making it very fast…

OpenAI building security tooling is the natural next step after AI-powered code generation, if AI writes the code, AI will need to find and fix the bugs in it too. The interesting …

Full disclosure, Ahmad, CEO at Corgea. Interesting approach, catching vulns at commit time before CI runs saves cycles. The challenge is always false positive rate at that stage an…

Delaying vulnerability disclosure for political reasons undermines the entire coordinated disclosure model. If researchers learn that findings get buried when inconvenient, they st…

[dead]

[flagged]

[dead]

The Corgea team has found a High vulnerability in Axios using our security research agent. This 0-day affects millions of globally. The cost of finding this vulnerability was <$10 …

Hi there, I'm Ahmad, CEO at Corgea, and the author of the white paper. We do actually use LLMs to find the vulnerabilities AND triage findings. For the majority of our scanning, we…

Very interesting. Thanks for sharing the insights! Would've it made more sense to separate this testing out to a different instance of your product? This would've probably helped d…

We completely agree. I would redefine it a bit. We combine static analysis + LLMs to do better detection, triaging and auto-fixing because static analysis alone is broken in many w…

I would redefine it a bit. Reliable = deterministic Accurate? Not at all. Studies show that ~30% of findings are false positive. We've also seen that with the companies we work wit…

Totally agree. We have a term for it "Dev confidence". Devs really don't want to touch something that's been working for a long time, especially in a codebase they're not familiar …

Yes