asadeddin

6 ms·

1.
Show HN: Sighthound - open-source vulnerability scanner for source code(github.com)
19 points by asadeddin 2mo ago|0 comments
2.
by asadeddin 3mo ago
OpenAI building security tooling is the natural next step after AI-powered code generation, if AI writes the code, AI will need to find and fix the bugs in it too. The interesting question is whether this stays infra-focused or moves toward
3.
by asadeddin 3mo ago
Full disclosure, Ahmad, CEO at Corgea. Interesting approach, catching vulns at commit time before CI runs saves cycles. The challenge is always false positive rate at that stage and the AI inference time. How fast is the review? I saw the d
4.
by asadeddin 3mo ago
Delaying vulnerability disclosure for political reasons undermines the entire coordinated disclosure model. If researchers learn that findings get buried when inconvenient, they stop reporting through official channels.
5.
by asadeddin 3mo ago
The Corgea team has found a High vulnerability in Axios using our security research agent. This 0-day affects millions of globally. The cost of finding this vulnerability was <$10 and 15 mins of time. It didn't use Mythos or Fable b
6.
Mythos: Given Enough Inference, All Bugs Are Shallow(corgea.com)
4 points by asadeddin 4mo ago|0 comments
7.
GitHub Actions Security Checklist for Supply Chain Attacks(corgea.com)
12 points by asadeddin 4mo ago|1 comments
8.
by asadeddin 1y ago
Hi there, I'm Ahmad, CEO at Corgea, and the author of the white paper. We do actually use LLMs to find the vulnerabilities AND triage findings. For the majority of our scanning, we don't use traditional static analysis. At the cor
9.
by asadeddin 1y ago
Very interesting. Thanks for sharing the insights! Would've it made more sense to separate this testing out to a different instance of your product? This would've probably helped distinguish between real and bounty users.
10.
Securing MCP Servers(corgea.com)
1 points by asadeddin 1y ago|0 comments
11.
Whitepaper: AI-powered security linter(corgea.com)
3 points by asadeddin 2y ago|0 comments
12.
by asadeddin 2y ago
We completely agree. I would redefine it a bit. We combine static analysis + LLMs to do better detection, triaging and auto-fixing because static analysis alone is broken in many ways. We've been able to reduce ~30% of tickets for cust
13.
by asadeddin 2y ago
I would redefine it a bit. Reliable = deterministic Accurate? Not at all. Studies show that ~30% of findings are false positive. We've also seen that with the companies we work with because we built a false positive detection feature i
14.
by asadeddin 2y ago
Totally agree. We have a term for it "Dev confidence". Devs really don't want to touch something that's been working for a long time, especially in a codebase they're not familiar with. The more removed the dev from
15.
by asadeddin 2y ago
Yes
16.
by asadeddin 2y ago
I agree. It would be nice if most SQL API's were secure by default to prevent SQLI. It's really something that the db connectors in the programming languages should handle with more grace like most ORMs today handle them pretty we
17.
by asadeddin 2y ago
Unfortunately, I realized the sentence reads weirdly. It's meant to say we use hundreds of repositories: close-source projects we own + open-source projects that are vulnerable by design + open source projects. I've updated the la
18.
by asadeddin 2y ago
That's what we've done. Unfortunately, I realized the sentence reads weirdly. It's meant to say we use hundreds of repositories: close-source projects we own + open-source projects that are vulnerable by design + open source
19.
We fine-tuned an LLM to triage and fix insecure code(corgea.com)
75 points by asadeddin 2y ago|63 comments
20.
by asadeddin 2y ago
I'm Ahmad, the founder of Corgea. We're building an AI AppSec engineer to help developers automatically triage and fix insecure code. We help reduce 30% of SAST findings with our false positive detection and accelerate remediation
21.
by asadeddin 3y ago
That's definitely a good way to do it, and if it works for you then awesome! We're kind of doing something similar here with this in a workflow where you don't have to share the key and it requires not technical knowledge of
22.
by asadeddin 3y ago
I totally understand that concern, and I'm pretty security conscious too my self. A few things, you can check the console and network logs while you're interacting with the application. You'll see we Retriever doesn't se
23.
by asadeddin 3y ago
That's a really interesting perspective. I thought of the anonymity piece as a feature more so than a limitation. For example, you want to share something between two people, but want to "burn after reading". This way no one
24.
by asadeddin 3y ago
You can send the URL in whatever medium is convenient. However, if someone gets a hold of the URL with the secret, they will not be able to see the secret. For example, here's a URL containing the secret. Can you see the secret? https
25.
by asadeddin 3y ago
You're correct. While a Mitm is possible, it'll be useless because the actor will have to get access to the private key from the requester'ss browser. They would have to be on the requester's machine
26.
by asadeddin 3y ago
Thanks for sharing that! We got a couple of PR's from very kind folks to fix that. We'll merge them soon.
27.
by asadeddin 3y ago
That's pretty much what Retriever.corgea.io is doing right now actually. It's hosted on GitHub pages, and serving a static HTML page. There's no other code running it. I'm not sure if they're using a CDN tho!
28.
by asadeddin 3y ago
That's scary convincible to a lot of folks.
29.
by asadeddin 3y ago
Your browser history will be full of URLs that only your browser can access. A contributor was kind enough to build a delete function for this to wipe the private key and generate a new one. This would render all those URL's useless. W
30.
by asadeddin 3y ago
Totally valid concern! Retriever.corgea.io is actually hosted on Github pages (do a CNAME check to see). https://mxtoolbox.com/SuperTool.aspx?action=cname%3aretrieve... You can see the canonical name is corgea.github.io whi

More ›