Open_Ultra_SAST

mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-16 03:49:26 +00:00

Files

T

Marius CiepluchandClaude Opus 4.8 04667c815e measure(g0): fair-target deep scan -- detection 3/5 on app-shaped+sound vs ~0 library-heavy

Ran ousast scan --mode deep on the 5 app-shaped + sound pool targets (the fair change-scoped
eval set from the shape classification). Detection 3/5: graphiti (hunter, Cypher injection),
mcp-remote (hunter, url-scheme injection), dcmcp (ENGINE overlay -- 'outbound.request reached
from parameter' on readFileFromUrl; parameter-as-source fired because an entry point is present).
2/5 missed: malla (DOM/template XSS) and dms (Jinja SSTI), both in families families.toml
documents as limited.

This validates the strategic pivot: the near-zero catch was substantially a TARGET MISMATCH --
on app-shaped repos the engine itself detects (0 -> 3/5). But all hits stop at suspicion/
static_corroboration; release-grade BLOCK still needs proof-arm elevation + family coverage +
the DSPy hint loop. Cost ~$0.007/repo. So bet #1 (fix eval target) is necessary and material
but not sufficient.

Next: recompute a floor on an app-shaped sound subset / real app corpus (VAmPI, NodeGoat,
DjanGoat, vibe-py); measure proof-arm suspicion->proven lift.

Co-Authored-By: Claude Opus 4.8 <[email protected]>

2026-10-12 11:16:35 +02:00

archive

ci: green again -- format and lint the whole tree; push the scan and runner images to GHCR on tags

2026-10-02 20:09:28 +02:00

search-with-proof: no-model demo replay (executor + verifier on a stored demo)

2026-10-06 14:50:14 +02:00

dev

ci: green again -- format and lint the whole tree; push the scan and runner images to GHCR on tags

2026-10-02 20:09:28 +02:00

experiments

learn: exp-005 graph slice -- inconclusive (within-pair AUC 0.762 -> 0.746, CI [-0.063, 0.032]); unsure rate 0.29 -> 0.24; fill \$1.59

2026-10-03 16:58:37 +02:00