mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
Marius CiepluchandClaude Opus 5
7ad3decf9a
On the 500-region population where every earlier run produced nothing: 153 of 406 questions completed and 125 findings, inside the deadline. 380 requests carrying 5,807 sink visits split into 11 batches, each answering in 80 to 197 s, none near the 300 s ceiling. Every family that can speak on this subject now does, injection included, which is the one holding a true positive here. Four defects, each hidden by the one before it, and three of them one rule. Batches sized by request count, when cost is per matched sink. Packing heaviest-first, which starved injection of all 114 of its questions. Any per-query timeout cancelling the whole scan, abandoning batches with 33 minutes left. No budget kept for arbitration, which removing that cancellation exposed: rows are not findings. The reserve had to be checked per BATCH. Checked between query kinds it changed nothing at all, because one kind is a single loop iteration that runs every one of its batches inside it. What it does not claim: 253 of 406 questions still went unanswered and one batch still records a timeout; the raw finding count is dominated by output encoding, the family already measured to be imprecise on PHP; and the reserve share of a fifth is a first value, not a tuned one. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo