HOME / WRITING

What we got wrong, mostly.

Notes from building a security scanner. Largely about false positives, because that is where the work is, and largely about our own — they are the ones we can prove.

8 min readFalse positivesStatic analysis

Why security scanners report their own rules as vulnerabilities

A scanner's pattern list contains every string it looks for. Point it at itself and it reads its vocabulary back as findings. We did that, got 128, and here is what each one turned out to be.

Read
6 min readAIFalse positives

Your scanner's AI is quoting your code correctly and citing the wrong line

A language model reproduces a passage accurately and counts the newlines before it badly. Ours put a regular expression at line 218 of a file that holds it at 410 - and that broke more than the reader's navigation.

Read
6 min readComplianceOWASP

OWASP Top 10:2025 — what actually changed

Injection moved to A05, Misconfiguration rose to A02, SSRF stopped being a category, and Vulnerable Components widened into Software Supply Chain Failures. If your report still cites 2021, it is quoting a retired standard.

Read