mirror of
https://github.com/norandom/OpenUltraSAST.git
synced 2026-10-17 12:09:27 +00:00
Marius CiepluchandClaude Opus 5
e245040855
The source, sink, sanitizer, operation, discharger and layout rows are not a pattern list. They are an ontology of program elements and their security relations, and nearly all of this tool accuracy lives there: the family census found five of seven families establishing nothing, every one for an ontology reason with the flow engine ready and nothing to aim at. The hook is general-purpose, not application-specific. The ontology describes libraries, frameworks and language constructs; it does not describe repositories. An entry names an API and is justified by what that API does, carries provenance and a weakness class, and may not encode a path or identifier peculiar to one project -- a plugin bundled library tree was measured and declined on exactly that ground. A measured gap is a candidate, never an entry: accretion by subject is how a general tool becomes a fixture of its benchmark. contributor-scan owns the ontology, so its design carries that statement and a new group 7 makes growth measurable rather than anecdotal: report what a repository calls that nothing models, key sanitizers to the weakness they prevent, skip arbitration where the evidence says there is nothing to find, share one matcher across the queries, require a degradation to declare its scope, and commit golden findings so a silent change cannot pass. pre-push-safety-net carries the general-purpose test for its own reviews, and a task for harnesses that report the cause of their own failure -- named by a week in which three separate causes looked identical as one count. Co-Authored-By: Claude Opus 5 (1M context) <[email protected]> Claude-Session: https://claude.ai/code/session_01EmM1j46qgKMh3zqD1QMwEo