Your security tools all speak different languages. SARIF makes them speak one. Table of Contents The Problem Picture a typical engineering team. They run a linter for code style, a SAST tool for security bugs, a secrets scanner, a container scanner, and maybe an infrastructure-as-code checker. Five tools. Five output formats. One tool spits out […]
Read More →Alibaba Open Code Review (OCR) is an open-source, AI-driven code review tool released by Alibaba under the Apache-2.0 license. Battle-tested internally for over two years by tens of thousands of Alibaba engineers, it is designed to find code defects with high precision and extreme token efficiency compared to general-purpose AI coding agents. Key Features & […]
Read More →A 2026 study found 26% of agent skills from public marketplaces contain vulnerabilities — and 5% show patterns of deliberate malice. NVIDIA’s SkillSpector scans skills before installation using static analysis and optional LLM review. This post covers what it catches, how to run it in CI, and the blind spots you still own. Table Of […]
Read More →SpotBugs is a program to find bugs in Java programs. It looks for instances of “bug patterns” — code instances that are likely to be errors. It uses static analysis to look for bugs in Java code. SpotBugs checks for more than 400 bug patterns. Bug descriptions can be found here. It is free software, […]
Read More →