mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-16 03:49:26 +00:00
Marius CiepluchandClaude Opus 4.8
a5a37374a7
Five public pool repos, vuln change each, clean host, 300s. The shipped engine added NO catches over the regex floor. 3/5 repos finished their region queue (deferred=0) and still emitted no finding, so change-scoping is not the path to catch. The engine ranked the vuln region in all 5 and found the right sink on 2 (score 2.0), but withholds any finding it cannot anchor 1:1 to changed lines -- all 5 hit ambiguous_line_correspondence -> witness_unresolved -> coverage incomplete, suppressing even the scored sinks. Confirmed not a shallow-clone artifact (correspondence is computed from both blobs). Reprioritised engine levers: #1 change-anchoring robustness (region-level witness fallback), #2 family ranking/taint coverage, #3 the LLM adjudication tier (the pilot is the case for it). Release read: the pre-push net is NOT releasable on detection yet. Co-Authored-By: Claude Opus 4.8 <[email protected]>