PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Streamline your static analysis triage with SARIF Explorer

blog.trailofbits.com | blog | #triage | #static-analysis | #tool-release | #codeql | #trail-of-bits | #semgrep | #sarif | #vscode | #vscode-extension
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Trail of Bits released SARIF Explorer, a VSCode extension for triaging static analysis results: open many SARIF files, classify findings as bugs or false positives, filter, and file GitHub issues.
Published
Collected

Related coverage

blog · blog.trailofbits.com
Auditing in the age of (good enough) AI
Trail of Bits explains how agents built tooling and a Lean model for the Miden zkVM audit, finding a flaw enabling Falcon signature forgery and yielding 95 machine-checked proofs.
blog · blog.trailofbits.com
Rust-proof your code with our new Testing Handbook chapter
Trail of Bits added a Rust testing chapter to its Testing Handbook: Miri, property testing, Clippy, zeroization, Kani model checking and dependency vetting, plus the rust-review Claude Code plugin.
blog · blog.trailofbits.com
Introducing mrva, a terminal-first approach to CodeQL multi-repo variant analysis
mrva is a terminal-first tool for CodeQL multi-repository variant analysis: it downloads pre-built databases via the GitHub API, runs custom queries locally, and prints SARIF results to stdout.
blog · blog.trailofbits.com
Read code like a pro with our weAudit VSCode extension
Trail of Bits released weAudit, a collaborative VSCode extension for security audits: bookmark findings, track audited files, keep a daily log, share notes with teammates, and create GitHub issues.
blog · blog.trailofbits.com
Publishing Trail of Bits’ CodeQL queries
Trail of Bits published custom CodeQL queries for Go and C that uncover issues standard queries miss: (EC)DSA misuse, insecure file permissions, string bugs, and missing TLS minimum versions.
research · theori.io
Offensive Security with Large Language Models (2)
Part two of Xint’s LLM offensive-security series: how LLMs assist static analysis where CodeQL falls short on third-party taint specs, plus injection risks in LLM-integrated web apps.
Back