[ Blog ]

Notes from the security gate

Benchmarks, vulnerability patterns in AI-generated code, and build notes. Written when there's something worth saying — not on a content calendar.

SecurityFixed before launch·7 min

We ran a security audit on ourselves before launch. It found a critical.

A pre-launch audit of our own codebase found a critical cross-tenant vulnerability in the GitHub install flow — anyone could have claimed another organisation's installation and read their private code. Then four more bugs surfaced, every one in code that already had passing tests.

Read post
BenchmarkBaseline published·5 min

Benchmarking Hypervex against real CVEs

Hypervex scored 47.1% F1 on the OpenSSF CVE Benchmark on its Gemini baseline — real vulnerabilities from real projects. The methodology, what it caught, and honestly what it missed.

Read post

In the pipeline

  • · How the Trace decides when a finding needs call-chain traversal
  • · What 30 fixed bugs in one inherited codebase taught us about silent failures
  • · Confidence calibration: what 87% should actually mean