Only 42 of 755 Static-Analysis Tools Are Open-Source Security Scanners

·1 views

An analysis of the public analysis-tools.dev catalog, which lists 755 static-analysis tools under an MIT license, found that while 86% of all tools are open source, only 42 qualify as both open-source and security-focused. Security scanners differ from general linters in that they trace potentially dangerous data flows, such as unparameterized SQL inputs, rather than flagging style or complexity issues. The gap is most striking at the language level: 21 languages that already have five or more general static-analysis tools, including Shell, SQL, PowerShell, and Dart, have no open-source security scanner at all. Security tooling is heavily concentrated in Python, Go, Java, and JavaScript, which each have between 9 and 13 dedicated scanners. The findings are drawn from a single publicly available dataset and the authors have published their parser and raw counts so the results can be independently verified.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How AI coding agent usage limits actually work and how to manage them

AI coding tools typically enforce usage limits through one of three mechanisms: token counts, request or message counts, or abstracted credits, and each model requires a different strategy to manage effectively. Many users also overlook that most tools run multiple simultaneous clocks, including a rolling short-term window and a longer billing-cycle cap, meaning a limit may reset far sooner than expected. A key technical detail is that entire conversation histories are re-sent with every turn in token-billed tools, making later turns in a session significantly more expensive than earlier ones. Rather than waiting out a reset, developers are advised to batch work into well-specified tasks upfront, since idle waiting erodes the accumulated context and problem-solving progress built during a session. Hard usage figures are intentionally omitted from this guidance, as vendor limits vary by plan and are frequently revised, making any specific numbers quickly outdated.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

Structured Task Design Makes AI Coding Agents More Reliable, Study Finds

AI coding agents are increasingly capable of handling complex development work, but output quality depends heavily on how tasks are prepared and assigned. Vague instructions leave too many decisions undefined, while well-structured tasks include a clear objective, scope boundaries, constraints, and a definition of done. Developers are advised to specify not only what should change but also what must remain unchanged, such as existing API contracts or dependencies. Before work begins, teams should decide how completion will be demonstrated — through tests, screenshots, or pull requests — to avoid subjective verification. The core principle is to treat AI-assigned work as verifiable units rather than one-off prompts, with a human still responsible for confirming product intent and catching unexpected side effects.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How to Extend Claude Code with MCP, Subagents, and Hooks for Production Use

Claude Code supports external integrations through Model Context Protocol (MCP), which allows it to connect with tools and services like GitHub, Sentry, and Notion via local or hosted MCP servers. Users can add MCP servers using the 'claude mcp add' command, with options to scope access privately, across all personal projects, or shared team-wide through a repository file. Subagents enable Claude Code to delegate tasks to isolated instances with their own context, preventing the main session from being cluttered with reusable or repetitive outputs. Slash commands allow users to package frequently used prompts into reusable shortcuts, while Hooks provide deterministic guardrails that enforce rules without relying on the AI's in-session memory. Together, these four features are designed to make Claude Code a more reliable and extensible tool for production workflows.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

How Outdated API Docs Silently Trained an AI Model to Write Broken Code

The team behind dailymeteo.com, a European meteorological archive, discovered that their fine-tuned GPT model had been trained on examples built from inaccurate API documentation. Key errors included a listed variable, sea-level pressure, that the API had never actually served, a hardcoded start year of 1960 when the archive begins in 1961, and incorrect timestamp format descriptions for climate mean data. Because training examples were written against the documentation rather than the live API, the model confidently generated well-formed but non-functional code for every affected query type. The incident highlights a systemic risk in fine-tuning workflows: documentation describes what a system is supposed to do, not necessarily what it does, and that gap can go undetected until someone tests the real endpoints.

0 comments Read more at DEV Community