Z.AI's GLM-5.3 desktop auditor, launched in partnership with Z.AI, offers free unmetered access to the GLM-5.3 API until October 2026, and has autonomously discovered 2,436 zero-day and legacy vulnera…
A 2025 Veracode analysis of over 100 large language models found that 45% of AI-generated code causes known security issues and vulnerabilities, while human review effectiveness drops after 400 lines …
A developer built BugZ AI, an open-source vulnerability scanner and automated patching engine that generates exact Git patch files to fix security issues. The tool uses Next.js, Convex, Clerk, and AI …
A developer's comparison of AI code review tools for GitHub in 2026 highlights Qodo as a standout for automated pull request reviews with repository-wide context, while noting CodeRabbit's diff-only a…
A developer describes using Claude as an unofficial senior developer to catch logic, architecture, and performance issues in code reviews. The developer's workflow involves pasting code and asking spe…
AI-written code can be shipped to production only after rigorous human review and automated testing, according to industry best practices. While AI models can accelerate development by 20% to 50%, ris…
Claude 3.5 Sonnet currently outperforms GPT-4o and DeepSeek-V2.5 in refactoring tasks due to better long-context logic handling and structural adherence, according to a developer's analysis. The model…
Aikido's 2026 State of AI in Security & Development report finds nearly 70% of organizations uncovered flaws tied to AI-generated code, with 1 in 5 reporting serious incidents linked to AI code. Engin…
Birgitta Boeckeler, a Distinguished Engineer at Thoughtworks focused on AI-assisted software delivery, discusses harness engineering for AI agents on the SE Radio podcast. She explains that harnesses …
A developer argues that StyleCop is outdated for modern .NET development, especially with AI-generated code, and recommends migrating to native .editorconfig and SDK analyzers for faster, built-in sty…
A developer warns that startups shipping AI-generated code without security review risk leaking API keys, hardcoded secrets, and misconfigured environments. The post provides a seven-point checklist c…
A developer describes how combining shift-left testing with machine learning can predict where bugs will appear before code is merged. By analyzing historical defect data and commit-level features suc…
A developer lost $12,000 in fraudulent Stripe charges after an AI agent hardcoded an API key into a public GitHub commit. The incident highlights the risk of giving LLMs direct access to codebases via…
SonarSource released a SonarQube plugin for Cursor that enables in-chat code quality and security checks. The plugin connects Cursor to any SonarQube instance via the SonarQube MCP Server, allowing de…
A developer explored integrating AI code review into Bitbucket and Jira workflows, finding that tools like Qodo can add an additional validation layer beyond traditional PR summaries. The AI reviewer …
Sonar reports that AI agents generate bloated, unmaintainable code, citing a Carnegie Mellon study of 807 open-source projects using Cursor that found a 30% rise in static analysis warnings and 41% in…
A developer researching code quality tools found that methods most tools rely on, such as complexity metrics and code smells, have weaker empirical evidence than expected. The research aims to identif…
An open-source project called Guard Skills has been released as a code quality alternative designed to catch systematic failure modes in AI-generated code, such as hallucinated APIs, mock abuse, and p…
In a 2025 benchmark comparing three industry static analysis tools against three frontier LLMs on sixty-three real vulnerabilities in ten C# projects, the LLMs achieved F1 scores between 0.75 and 0.80…
Secure Code Warrior extended its AI agent at the Gartner Security & Risk Management Summit to surface real-time training insights as developers write code, linking the SCW Trust Agent to the company's…