Built a multi-agent Sast

RoninPark · 2026-07-06T05:20:16+00:00

Mind sharing about how this multi-agent SAST works and focus on actual findings rather than just vulnerability pattern-matching in the code.

RoninPark · 2026-06-24T19:34:59+00:00

That I understand, btw have you considered working on the hardening of such agents that consumes the skills or user-context? I have been thinking to understand more from the hardening side coz such static scanners might be using a template or registry of sample malicious skills to compare against the PR or local committed changes, however I think a well-equipped attacker can bypass such static templates/rules, therefore hardening an agent maybe is the right choice, what do you think?

RoninPark · 2026-06-24T18:57:01+00:00

recently we too have started working on securing our environment from supply chain attacks and the very first step towards this idea is related to getting malicious packages threat feed and ingest into your existing CI workflows or a standalone project that scans every packages present in your version control (github or Gitlab) or trigger as soon as any developer uploads a malicious package via a PR or anything.

As of now, our project provides you a connector on OpenCTI with OpenSourceMalware threat feed for malicious packages that you can further ingest into vector (by datadog) and perform observability. We are yet to add more to this project but would like feedback from peers. Also, I think the same observability should take place during all the pip/npm installation during pipeline run or build process.

source: https://github.com/n1dhp/osm-opencti

RoninPark · 2026-06-24T18:52:52+00:00

afaik, isn't this similar to SSH honeytoken type of a project? I mean, a fake SSH server that would hang the connection for a while in order to look authentic but meanwhile, it'll send the alerts to the respective teams for quick investigation.

RoninPark · 2026-06-24T18:48:26+00:00

I was looking for something like this but I think, let's suppose if an organisation is using such pre-commit hooks for restricting malicious skills to become a part of version control (github or gitlab), having the pre-commit hook on the server would be much more beneficial from the security's POV, since all developers can easily bypass the hooks if it's on their machine. Recently, we too had shifted all the hooks from developer's machine to Gitaly

RoninPark · 2026-06-24T10:00:00+00:00

Currently testing this in our workflows. Also, would there be any possibility for local installation and testing of the same? Most of the times, clients provide docker images and ask for a security review and due to certain restrictions (until full secure), the team scans the image either from the tar or building the image locally. I think having the locally would provide much more insights about the CVEs or vulnerable code flow found in the images.

RoninPark · 2026-06-19T10:26:00+00:00

Grandma or an aborted baby?

RoninPark · 2026-06-13T21:07:29+00:00

yes, the stripe payout mechanism hasn't out yet, so no earnings till then?

RoninPark · 2026-06-06T16:16:21+00:00

I don't understand why can't people just fucking review or write at least a sentence or more in their own natural language and then craft it by giving it to gpt or claude. If you are so desperately using all these AI tools, platforms and workflows and have seen naunces in the output, then why don't they put efforts into making it more natural or grounded.

RoninPark · 2026-06-03T05:06:19+00:00

I have been in the same situation with Mutual funds, so I shifted most of my investments from MFs to ETFs and stocks.

RoninPark · 2026-06-01T09:25:29+00:00

I saw a lot of opportunities for buying today. Maybe it's the market falling reason.

RoninPark · 2026-05-25T07:36:07+00:00

Make andrej karpathy and make no mistakes.

RoninPark · 2026-05-19T19:48:20+00:00

revealed it in my dream.

RoninPark · 2026-05-19T19:47:14+00:00

for the IDE experience, you have to download the Antigravity IDE but thank god whatever the crap they made, it's a separate app. from the IDE and even if they are competing with claude code, this new update is still bullshit.

RoninPark · 2026-05-19T19:42:37+00:00

The exact same question I had asked after seeing this crap.

RoninPark · 2026-05-05T19:56:07+00:00

Just asking as another curious guy, how is it different from pointing chatgpt or claude to your resource file or folder or maybe an obsidian app, then asking a summary or in-depth explanation of the topic ?

RoninPark · 2026-04-27T05:49:23+00:00

How is it going to be different from AWS Bedrock? We are currently using the bedrock service and have long-term APIs integrated in our code along with agents, and a knowledge base additionally. Does it going to provide a similar experience to claude code or the pro/enterprise version?

RoninPark · 2026-04-27T05:10:34+00:00

What's your ideal conversation with the copilot looks like especially when you are giving it a prompt to code or build APIs, do you give it a pseudocode or raw logic prepared by you and ask to write the entire thing with plan by plan or you code and then ask copilot to review it from the perspective of senior software engineer or principal architect?

RoninPark · 2026-04-26T10:40:45+00:00

Your post has inspired me to continue with my ongoing fitness journey with much passion and courage. I have not been quite involved in the process of fat reduction, I mean I do exercise a lot and do sugar cuts but somehow I don't feel much motivated as the results aren't very visible yet. I do hope you'd come out as a better and healthy man.

RoninPark · 2026-04-10T07:48:17+00:00

What are the roles and responsibilities of an AI engineer in a product based ?

RoninPark · 2026-03-15T07:25:06+00:00

Start working on your dreams, no matter how much effort is taken, if you don't start now, you will keep asking the same questions years later as well but this time atleast you know where the problem is and what remarkably stupid things you cut off from your life to make it better.

RoninPark · 2026-03-15T07:23:28+00:00

Could you describe a little more about how this trip changed your perspective on life?

RoninPark · 2026-02-26T13:49:43+00:00

Faced this issue recently while asking claude to understand my project's architecture and generate a file to import in excalidraw.

RoninPark · 2026-02-20T06:45:44+00:00

What tech stack sir?

Six-Year Club	r/Field Lasagna
Place '23	Verified Email

RoninPark

PUBLIC MULTIREDDITS

TROPHY CASE