How the systems were built, how the tools were measured, and what my own tools got wrong. Benchmarks and dead ends included.
The live eval landed at 100% recall and precision. Then I pointed the scanner at a real open-source repo and it found one genuine bug in eleven candidates. The gap was in my benchmark, not the model.
Why pattern-matching SAST misses broken access control, how a four-phase Claude agent pipeline finds it, and the seeded benchmark that keeps the whole thing honest.
A real-time collaborative workspace where you design systems instead of typing them, and the context-managed workflow that built it. Notes on what senior engineering looks like when implementation becomes a commodity.
Turning a vulnerability lab into a shippable scanner. From research artifact to npm package, with token-only and live-endpoint modes, in one weekend.
How a one-line algorithm header turns authentication into security theater, and why allowlisting is the only fix.