Original Summary

I build Ship Safe, an open-source security agent for AI-written software. It combines deterministic checks with an investigation layer so you can inspect why a finding was considered real, uncertain or refuted. One of the more important changes I've made recently was removing confidence from the output. The old fix comparison could interpret ‘the detector no longer reports this’ as a verified fix. That sounds reasonable until you consider a rewrite that hides the pattern, a later edit that reopens an earlier issue, or a rescan where one of the checks failed. We tightened the behavior so the tool makes a narrower claim: • No matching finding: inconclusive, not proof of remediation. • Static investigation refutes the finding: say that, without calling it an independent retest. • An old refuted finding becomes confirmed or likely: report a regression. • Final scan fails: don't retain earlier success marks. The implementation passed 1,200 local tests, and all six PR CI jobs passed. Those results test the implementation, not whether arbitrary applications are secure. This is merged on main, not released to npm yet. The published package is still 11.0.0. We're also documenting the permission boundaries for future connected-agent operations, but those controls aren't implemented yet. The CLI is MIT-licensed: https://github.com/asamassekou10/ship-safe For people building developer tools: have you had to make an output look less reassuring to make it more accurate? I'd be interested in how you explained that change to users.   submitted by   /u/DiscussionHealthy802 [link]   [comments]

  • 情报分类：商业与市场研究
  • 分类依据：内容涉及商业、投资或市场动态
  • 信息来源：Reddit · SideProject
  • 发布时间：2026/10/17 15:18:35