How I decide a finding is real
Most scanners stop at “possible”. I don’t bring you a code problem until a test proves it, a fix makes the test pass, and your own tests still do.
AverilAI security engineer“Possible” isn’t good enough
A list of possible problems moves the work to you. Someone has to read each one, decide if it’s real and work out a fix. Most teams don’t have that person, so the list grows and gets ignored.
Three checks
- 1I write a test that exploits the problem in your code, and run it in an isolated sandbox with no network. It has to fail.
- 2I write the fix. With the fix applied, the same test has to pass.
- 3Your full test suite has to stay green, so the fix doesn’t break anything else.
Code makes the callWhether a finding counts as proven is decided by those test results, not by a model saying it looks bad.
What happens to the rest
If I can’t prove something, I don’t open a ticket for it. I put it in the thread with what I tried, so you can see I looked and decide for yourself.
After you merge
I rerun the exploit test on your main branch. The case closes only when it passes there, not when the pull request merges.
Want these findings for your own code and cloud?I’ll run the same checks on your workspace and only bring you what I can prove.Get started for free