marius/Open_Ultra_SAST
1
0
Fork 0
mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-16 11:49:28 +00:00
Code Issues Packages Projects Releases Wiki Activity
Files
13a20008e7aaac5a8d27e2521ceffa3b92aa7ebe
Open_Ultra_SAST/benchmarks
T
History
Marius CiepluchandClaude Fable 5.1 bf243e6680 search-with-proof: family-to-oracle mapping, build memory, tolerant tool calls 
Demos declare their oracle within the family allowed set (injection: sql or
command; output_encoding: xss; untrusted_destination: ssrf; path: path);
builds and app starts use the search memory budget instead of the 256 MB tool
limit (npm died with SIGTRAP); malformed tool-call JSON is fed back once.

Co-Authored-By: Claude Fable 5.1 <[email protected]>
2026-10-05 21:07:58 +02:00
..
archive
ci: green again -- format and lint the whole tree; push the scan and runner images to GHCR on tags
2026-10-02 20:09:28 +02:00
ax
ax batch: workload-kind prefixes in task names (pass-, replay-) [skip ci]
2026-10-05 20:33:35 +02:00
dev
ci: green again -- format and lint the whole tree; push the scan and runner images to GHCR on tags
2026-10-02 20:09:28 +02:00
experiments
learn: exp-005 graph slice -- inconclusive (within-pair AUC 0.762 -> 0.746, CI [-0.063, 0.032]); unsure rate 0.29 -> 0.24; fill \$1.59
2026-10-03 16:58:37 +02:00
fixtures
feat(ruleset): PHP quick-mode rules from the engine's vocabulary, measured on the development corpus
2026-09-30 15:05:47 +02:00
independent
ci: green again -- format and lint the whole tree; push the scan and runner images to GHCR on tags
2026-10-02 20:09:28 +02:00
learn
ax batch: workload-kind prefixes in task names (pass-, replay-) [skip ci]
2026-10-05 20:33:35 +02:00
manifests
feat(ruleset): PHP quick-mode rules from the engine's vocabulary, measured on the development corpus
2026-09-30 15:05:47 +02:00
measurements
search-with-proof: executor smoke driver and pilot selection (6.1)
2026-10-05 17:26:06 +02:00
pairs
learn: 251 more advisory-fix pairs whose function survives the fix (advisory-fixes-3)
2026-10-04 11:57:34 +02:00
push
perf(taint): ask the caller check only of a parameter that starts a flow into the field
2026-09-23 22:49:44 +02:00
ranking
feat(pre-push-safety-net): preserve uncertainty in benchmark scoring
2026-09-12 19:04:20 +02:00
repos
feat(pre-push-safety-net): pin labeled evaluation inputs
2026-09-12 18:45:54 +02:00
search
search-with-proof: family-to-oracle mapping, build memory, tolerant tool calls
2026-10-05 21:07:58 +02:00
unseen
ax batch: workload-kind prefixes in task names (pass-, replay-) [skip ci]
2026-10-05 20:33:35 +02:00