{"slug": "let-ai-triage-static-analysis-alerts-without-letting-it-hide-bugs", "title": "Let AI Triage Static-Analysis Alerts Without Letting It Hide Bugs", "summary": "A developer proposes a design pattern for using AI to triage static-analysis alerts while preventing the model from hiding bugs. The pattern keeps detection and disposition separate, binds proposals to scanner rules and source revisions, and requires cited evidence. It never auto-suppresses findings involving security-sensitive categories and mandates that suppressed findings reopen when code changes.", "body_md": "“Use AI to remove static-analysis false positives” sounds like a classification feature. In production it is an authorization feature: who may hide a warning, for how long, with what evidence, and what happens when the code changes?\n\nKeep detection and disposition separate.\n\n``` php\nscanner -> immutable finding -> context builder -> AI proposal\n                                      |               |\n                                      v               v\n                               source snapshot   evidence bundle\n                                                      |\n                                                      v\n                                      deterministic policy / reviewer\n                                                      |\n                                                      v\n                                           time-bounded disposition\n```\n\nThe model should never delete a finding. It proposes one of `needs_review`\n\n, `likely_false_positive`\n\n, or `likely_true_positive`\n\n, plus cited code ranges and reasoning.\n\n```\ntype TriageProposal = {\n  findingId: string;\n  scannerRule: string;\n  sourceRevision: string;\n  verdict: \"needs_review\" | \"likely_false_positive\" | \"likely_true_positive\";\n  citedRanges: Array<{ path: string; start: number; end: number }>;\n  modelId: string;\n  promptVersion: string;\n};\n\ntype Disposition = {\n  proposalId: string;\n  action: \"keep_open\" | \"suppress_until_change\";\n  decidedBy: string;\n  decidedAt: string;\n  expiresAt: string;\n};\n```\n\nBind every proposal to the scanner rule and source revision. If a cited file, data flow, dependency, or rule version changes, reopen the finding. “Suppressed forever” is not a recovery policy.\n\nNever auto-suppress findings involving credentials, authorization, injection sinks, unsafe deserialization, cryptography, or public network exposure. Require cited ranges to exist in the scanned revision. Reject proposals with missing evidence. Sample accepted suppressions for review and track reopen rate by rule and repository.\n\nYour evaluation set needs confirmed true positives, confirmed false positives, ambiguous cases, and code changes that invalidate an earlier disposition. Measure missed true positives separately from analyst time saved; averaging them into one accuracy number hides the expensive error.\n\nThe public [MonkeyCode repository](https://github.com/chaitin/MonkeyCode) describes automated PR/MR review, AI tasks, and managed development environments. The contract above is applicable to AI-assisted review generally, but it is not a claim about MonkeyCode's scanner integrations or current suppression behavior.\n\nDisclosure: I contribute to the MonkeyCode project. Product context comes from public documentation; this workflow is an independent design pattern.\n\nAI can reduce review effort by assembling context. Authority to hide security evidence should remain explicit, reversible, and auditable.", "url": "https://wpnews.pro/news/let-ai-triage-static-analysis-alerts-without-letting-it-hide-bugs", "canonical_source": "https://dev.to/kongkong1/let-ai-triage-static-analysis-alerts-without-letting-it-hide-bugs-759", "published_at": "2026-07-12 15:12:16+00:00", "updated_at": "2026-07-12 15:15:19.072513+00:00", "lang": "en", "topics": ["ai-safety", "developer-tools", "ai-agents", "machine-learning", "ai-ethics"], "entities": ["MonkeyCode", "Chaitin"], "alternates": {"html": "https://wpnews.pro/news/let-ai-triage-static-analysis-alerts-without-letting-it-hide-bugs", "markdown": "https://wpnews.pro/news/let-ai-triage-static-analysis-alerts-without-letting-it-hide-bugs.md", "text": "https://wpnews.pro/news/let-ai-triage-static-analysis-alerts-without-letting-it-hide-bugs.txt", "jsonld": "https://wpnews.pro/news/let-ai-triage-static-analysis-alerts-without-letting-it-hide-bugs.jsonld"}}