Open_Ultra_SAST

mirror of https://github.com/norandom/OpenUltraSAST.git synced 2026-10-16 19:59:26 +00:00

Files

T

Marius CiepluchandClaude Opus 5.5 32eb46f297 measure(independent): model-classified sinks put the vulnerable function in scope in 15/17

Source-only selection on the v2 vulnerable pins, compared on the same cases:
- ranker top-20 entry points: the vulnerable file was in scope in 1/17;
- shipped-vocabulary sink-first: the declared site was a candidate in 2/17;
- model-classified sinks (deepseek-flash, no vocabulary): the declared site was a
  candidate in 15/17, and a fix or site file in 16/17. Every chunk was classified;
  $14.42.
Misses: User Registration (file in scope, not the function) and Sulu (JCR-SQL2
query builder). The cost of this reach is volume: 3-1037 candidate functions per
repository, 4,762 in total. The next stage must decide which candidates are fed by
attacker data without a guard. v2 is spent for tuning; this qualifies nothing.

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo

2026-09-28 13:21:41 +02:00

evaluate.py

measure(independent): the unchanged tool hunter on population v2 -- recall 1/17, and why

2026-09-28 11:36:32 +02:00

freeze-v1.json

spec(pre-push-safety-net): freeze the independent population v1 (15.1)

2026-09-24 16:43:32 +02:00

freeze-v2.json

spec(pre-push-safety-net): freeze the independent population v2

2026-09-26 18:02:03 +02:00

freeze.py

spec(pre-push-safety-net): freeze the independent population v2