DEV Community

CopperSunDev profile picture

CopperSunDev

Engineering notes on AI code safety, static analysis, and what scanners can and can't catch.

Location Redwood City Joined Joined on  Personal website https://coppersun.dev/ github website
Will Your AI Write A Regex That Hangs Your Server?

Will Your AI Write A Regex That Hangs Your Server?

Comments
7 min read
IDOR and Access Control in AI APIs, by the Numbers

IDOR and Access Control in AI APIs, by the Numbers

Comments
7 min read
The CVE Record on Insecure Deserialization in AI Python Code

The CVE Record on Insecure Deserialization in AI Python Code

Comments
7 min read
AI Code License Risk From Training-Data Memorization

AI Code License Risk From Training-Data Memorization

Comments
7 min read
Why AI Transcription Is Affordable Now

Why AI Transcription Is Affordable Now

Comments
6 min read
How AI Adds Punctuation to Transcripts

How AI Adds Punctuation to Transcripts

Comments
6 min read
How Speech Quality Is Measured for Transcription

How Speech Quality Is Measured for Transcription

Comments
7 min read
Run BrassCoders Automatically in a Claude Code Hook

Run BrassCoders Automatically in a Claude Code Hook

Comments
5 min read
LLM Code Reviewer Reliability, by the Numbers

LLM Code Reviewer Reliability, by the Numbers

Comments
6 min read
Scan, Patch, Re-Scan: Verifying AI Bug Fixes

Scan, Patch, Re-Scan: Verifying AI Bug Fixes

Comments
5 min read
AI Package Hallucination Rate: 96 Names Checked On PyPI

AI Package Hallucination Rate: 96 Names Checked On PyPI

Comments
7 min read
AI Code Defect Rates: The Q3 2026 Data Report

AI Code Defect Rates: The Q3 2026 Data Report

Comments
6 min read
How to Run BrassCoders on Every Commit (and Why It Isn't Automatic)

How to Run BrassCoders on Every Commit (and Why It Isn't Automatic)

Comments
4 min read
Command Injection in AI-Generated Express.js: A Real Scan

Command Injection in AI-Generated Express.js: A Real Scan

Comments
5 min read
AI Coding Tool Security Risk for Engineering Leaders

AI Coding Tool Security Risk for Engineering Leaders

Comments
7 min read
Tuning .brassignore: Suppressing a False Positive in Three Steps

Tuning .brassignore: Suppressing a False Positive in Three Steps

Comments
5 min read
From HIGH to Clean: Removing a Hardcoded HMAC Key in AI-Generated Python

From HIGH to Clean: Removing a Hardcoded HMAC Key in AI-Generated Python

Comments
5 min read
From SQL Injection to Clean: Fixing a B608 Finding in AI-Generated Flask Code

From SQL Injection to Clean: Fixing a B608 Finding in AI-Generated Flask Code

Comments
6 min read
What Static Analysis Cannot See: A Complete Map of the Limit

What Static Analysis Cannot See: A Complete Map of the Limit

Comments
10 min read
How to Run Your First BrassCoders Scan on AI-Generated Python

How to Run Your First BrassCoders Scan on AI-Generated Python

Comments
2 min read
What's the Cost of a SQL Injection in AI-Generated Code?

What's the Cost of a SQL Injection in AI-Generated Code?

Comments
2 min read
Can BrassCoders Catch Race Conditions in Async Python?

Can BrassCoders Catch Race Conditions in Async Python?

Comments
2 min read
Does BrassCoders Scan Node.js and TypeScript Code?

Does BrassCoders Scan Node.js and TypeScript Code?

Comments
2 min read
AI Coding Assistant Vendor Risk: What Your Security Team Should Ask

AI Coding Assistant Vendor Risk: What Your Security Team Should Ask

Comments
6 min read
The Trust Boundary Problem in AI-Generated Code

The Trust Boundary Problem in AI-Generated Code

Comments
5 min read
Business Logic Bugs Static Analysis Will Never Catch

Business Logic Bugs Static Analysis Will Never Catch

Comments
5 min read
What to Ask a Static Analysis Vendor When Your Team Uses AI Code

What to Ask a Static Analysis Vendor When Your Team Uses AI Code

Comments
4 min read
The Security Manager's Brief on AI-Generated Code Risk

The Security Manager's Brief on AI-Generated Code Risk

Comments
3 min read
Quantifying AI Code Risk: A Framework for Engineering Leaders

Quantifying AI Code Risk: A Framework for Engineering Leaders

Comments
4 min read
Building the Business Case for AI Code Scanning

Building the Business Case for AI Code Scanning

Comments
3 min read
What Python Versions Does BrassCoders Support?

What Python Versions Does BrassCoders Support?

Comments
2 min read
What's the Difference Between .brassignore and .gitignore?

What's the Difference Between .brassignore and .gitignore?

Comments
2 min read
What Does a BrassCoders Scan Output Look Like?

What Does a BrassCoders Scan Output Look Like?

Comments
2 min read
How Long Does a BrassCoders Scan Take?

How Long Does a BrassCoders Scan Take?

Comments
2 min read
How Do I Read .brass/ai_instructions.yaml?

How Do I Read .brass/ai_instructions.yaml?

Comments
2 min read
Does BrassCoders Work With pyproject.toml?

Does BrassCoders Work With pyproject.toml?

Comments
2 min read
Does BrassCoders Work With Django REST Framework?

Does BrassCoders Work With Django REST Framework?

Comments
2 min read
Can I Run BrassCoders Offline? Yes — Here's How

Can I Run BrassCoders Offline? Yes — Here's How

Comments
2 min read
What AI Coding Agents Leave Behind in Production

What AI Coding Agents Leave Behind in Production

Comments
4 min read
Your README Is an Attack Surface for AI Agents

Your README Is an Attack Surface for AI Agents

Comments
4 min read
Pydantic v2 Validation Bugs AI Assistants Write

Pydantic v2 Validation Bugs AI Assistants Write

Comments
4 min read
OWASP Agentic Top 10 for Python Developers

OWASP Agentic Top 10 for Python Developers

Comments
5 min read
MCP Tool Poisoning: What Static Scanners Miss

MCP Tool Poisoning: What Static Scanners Miss

Comments
4 min read
Coverage Theater: AI Tests That Don't Test Anything

Coverage Theater: AI Tests That Don't Test Anything

Comments
4 min read
AI Type Hints That Fool mypy and Break at Runtime

AI Type Hints That Fool mypy and Break at Runtime

Comments
4 min read
AI-Generated requirements.txt and Vulnerable Packages

AI-Generated requirements.txt and Vulnerable Packages

Comments
4 min read
AI-Generated Migrations: The Data Loss Pattern

AI-Generated Migrations: The Data Loss Pattern

Comments
4 min read
Why AI Code Breaks in Production: The Happy-Path Bias

Why AI Code Breaks in Production: The Happy-Path Bias

Comments
4 min read
Ruff Won't Catch Security Bugs Unless You Ask It To

Ruff Won't Catch Security Bugs Unless You Ask It To

Comments
5 min read
AI Code Security Scanners: Who Fills Which Role

AI Code Security Scanners: Who Fills Which Role

Comments
10 min read
What AI Recommends to Catch AI's Own Bugs

What AI Recommends to Catch AI's Own Bugs

Comments
3 min read
The Authorization Bug No Scanner Understands

The Authorization Bug No Scanner Understands

Comments
4 min read
Every AI Code Review Blind Spot Is the Same One

Every AI Code Review Blind Spot Is the Same One

Comments
4 min read
Brass-SEO's Case Study on Our Boundary Content

Brass-SEO's Case Study on Our Boundary Content

Comments
1 min read
The Slow Code No Scanner Can Flag

The Slow Code No Scanner Can Flag

Comments
3 min read
Security Misconfiguration Is a Runtime Fact

Security Misconfiguration Is a Runtime Fact

Comments
3 min read
What BrassCoders Sends to Its Servers (And What It Doesn't)

What BrassCoders Sends to Its Servers (And What It Doesn't)

Comments
7 min read
How to Triage a 500-Line AI Pull Request in 10 Minutes

How to Triage a 500-Line AI Pull Request in 10 Minutes

Comments
7 min read
Why Claude Code Emits Eight Findings When One Matters

Why Claude Code Emits Eight Findings When One Matters

Comments
4 min read
Copilot Does X. BrassCoders Does Y.

Copilot Does X. BrassCoders Does Y.

Comments
5 min read
loading...