bitcoder-v2-research

BitCoder-v2 연구 조직: Bytepro AI 상태: 연구 진행 중 — 비공개 저장소 목표: arXiv 2026년 3분기 + ARC Prize 논문 트랙 2026년 11월 연구 목표 수학적 추론SAIR, arXiv:2504.18897에서 관찰된 단일 프롬프트 한계가 코드 보안 취약점 탐지에서도 재현된다는 것을 경험적으로 입증하여, 라우터 가설이 도메인 독립적임을 확인한다. 논문 주장 gpt-oss-20b + 구조화된 치트시트는 합성 분포Juliet, OWASP Benchmark에서 프론티어 모델에 필적하지만, 실세계...

cq

cq Code Query, 범용 코드 보안 스캐닝 도구. CQ는 보안 취약점과 보안 중심 코드 리뷰어에게 관심을 끄는 기타 항목을 코드에서 스캔합니다. 발견된 문제에 대한 참조가 포함된 텍스트 파일을 출력 디렉토리에 생성합니다. 이 출력 파일들은 이후 검토하거나, grep과 같은 unix 명령줄 도구로 필터링하거나, 지정된 file:line 참조에서 코드베이스로 '점프'하는 수단으로 사용할 수 있습니다. 널리 사용되는 방식 중 하나는 출력 파일을 '할 일todo' 목록으로 간주하여, 검토하면서 오탐false positive으로...

Zarafa WebApp <=2.0.1.47791 - Cross-Site Scripting

Zarafa WebApp 2.0.1.47791 and earlier contains an unauthenticated reflected cross-site scripting vulnerability. An attacker can execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. id: CVE-2019-7219 info: name: Zarafa WebApp =2.0.1.47791 -...

duo-agentflow-auditor

Duo AgentFlow Auditor AI 코드 보안 — AI 생성 코드에서 SAST가 놓치는 것을 포착합니다 GitLab Duo Agent Platform 기반 AI 생성 코드의 40-62%에 보안 취약점이 포함되어 있습니다. 기존 SAST는 CVE를 탐지합니다. 우리는 SAST가 놓치는 것 — 프롬프트 인젝션, LLM 출력 실행, 안전하지 않은 ML 역직렬화를 탐지합니다. 시작하기 · 아키텍처 · 탐지 규칙 · 설정 가이드 · 구현 문제점 AI는 코드 생성을 가속화하지만 새로운 보안 병목 현상을 만듭니다: 문제| 영향...

cq

cq Code Query, 범용 코드 보안 스캐닝 도구입니다. CQ는 코드에서 보안 취약점과 보안에 중점을 둔 코드 리뷰어에게 관심 있는 기타 항목을 스캔합니다. 발견된 문제에 대한 참조가 포함된 텍스트 파일을 출력 디렉터리로 출력합니다. 이러한 출력 파일은 검토하거나, grep과 같은 유닉스 명령줄 도구로 필터링하거나, 지정된 file:line 참조에서 코드베이스로 '점프'하는 수단으로 사용할 수 있습니다. 널리 사용되는 방식 중 하나는 출력 파일을 'todo' 목록으로 간주하여, 검토하면서 오탐으로 판단되는 참조를 삭제하거...

VCG — Updated!

==================================================================================== VCG VisualCodeGrepper Current version: 2.3.2 ==================================================================================== Contents: 1. Overview 2. Latest additions to VCG V2.3.2 3. Using VCG Input...

MINI-6VGX-C24M-5JJG

Bulletin has no description...

MINI-FPF6-RH63-PC7C

Bulletin has no description...

MINI-PXF8-9G5P-26FJ

Bulletin has no description...

Context-Based Adversarial Attacks on AI Code Generators: Vulnerability Analysis and Implications

AI-powered code generation systems have transformed software development but introduce critical inference-time security vulnerabilities. This research presents a systematic investigation of context-based adversarial attacks, where strategically crafted contextual inputs, including comments,...

Revisiting Vul-RAG: Reproducibility and Replicability of RAG-Based Vulnerability Detection with Open-Weight Models

Large language models LLMs have shown strong potential for automated software vulnerability detection, particularly in retrieval-augmented generation RAG settings. However, for approaches relying on proprietary models and APIs, reproducibility and replicability remain largely unexplored, raising...

How to Compare the Security of Code Written by Humans to LLM-Generated Code

Large language models LLMs are rapidly transforming how software is created and maintained. Comparing LLM-generated code against human-written standards is essential to determine whether these new tools uphold or erode the security baselines established by professional developers. Yet, we lack a...

R+R: Reassessing Java Security API Misuse in Current LLMs: A Replication on JCA and JSSE APIs with External Security Knowledge

The misuse of Java security APIs is a serious security problem in software development. Research in 2024 has shown that this problem is widespread in LLM-generated code. However, it remains unclear whether this phenomenon persists in current models and how external security knowledge affects it...

Budibase 安全漏洞

Budibase is an open-source low-code platform developed by Budibase in the UK. It allows for the creation of internal applications, workflows, and management panels within minutes. Versions of Budibase prior to 3.38.1 contained security vulnerabilities. These vulnerabilities stemmed from the V1 vi...

An Empirical Evaluation of LLM-Generated Code Security across Prompting Methods

The growing use of Large Language Models LLMs for automated code generation has enhanced software development efficiency, but often at the cost of security. Generated code frequently overlooks critical concerns, leaving it vulnerable to issues such as weak encryption and improper input validation...

Security Incentivization: An Empirical Study of How Micropayments Impact Code Security

Security often receives insufficient developer attention because it does not directly generate visible value, leading to underinvestment in practice. We evaluate a countermeasure by team-level incentives tied to measurable security improvements over time. Our semi-automated mechanism aggregates...

Bringing AI Code Security into Qualys ETM

A first-class data model for the next generation of findings AI-driven code security is becoming a real category. Anthropic's Claude Code Security and OpenAI's Codex Security are the leading examples, and more will follow. These tools reason about source code at a depth that traditional SAST cann...

Closing the Security Gap in the Age of Agentic Coding

AI agents are writing more and more code. Ensure it's secure. Learn how Wiz Code plugins and the Green Agent bring machine-speed remediation to your AI-IDE...

How exposed is your code? Find out in minutes—for free

Most security leaders share the same suspicion: there are vulnerabilities in our codebase that we don't know about. The uncomfortable truth is that most code never gets a thorough security review. Vulnerabilities accumulate quietly in active repositories, across languages and teams, often...

CVE-2026-34566 CI4MS: Pages Management Full Account Takeover for All-Roles & Privilege-Escalation via Stored DOM XSS

CI4MS is a CodeIgniter 4-based CMS skeleton that delivers a production-ready, modular architecture with RBAC authorization and theme support. Prior to version 0.31.0.0, the application fails to properly sanitize user-controlled input within the Page Management functionality when creating or editi...