alt Hacker NewsIf you're not already applying static analysis and linters to your codebase (and I know many of you aren't), ask yourself why you would bother to apply an expensive LLM tool?
Not to say these things won't catch vulnerabilities static tools cannot, I think they can, it's just we already have the capability to automatically catch a large surface area of common vulns, and have chosen not to, often for expense reasons.
If you're a team that does already apply several layers of analysis and linting, and wants to add this on top, all power to you.
Replies
Static analysis often shows many false positives. A more intelligent tool can help not to waste limited engineering time.
Static analysis won't develop a one click exploit that works end to end for you.
I'm at a FAANG and even our static analysis tools are not great at identifying how many issues are actually reachable.
Ideally you use both. An AI model that has static analysis as part of the harness, so it can evaluate each potential finding.
[dead]
> If you're not already applying static analysis and linters to your codebase
Because most issues are in business logic that static analyzers aren't going to catch.