Blog

Writing on reproducible security analysis.

Research, engineering, and honest product thinking from the scanipy team.

EngineeringMay 14, 2026 · 12 min read

Why byte-identical SARIF is the only meaningful reproducibility guarantee

Most SAST tools claim determinism. We explain why "same findings" is a much weaker claim than "same SARIF", and why the difference matters when you hand results to an auditor.

Read post →
Research

Anytime-valid inference for detection spec acceptance

How we replaced a classical α-spending function with an e-process that works under unbounded re-evaluation, and why the difference is not academic.

May 7, 2026 · 9 min
Engineering

Incremental CPG maintenance on a 100k-file monorepo

A walkthrough of our closed-world precondition detector and the fallback path for open-world code.

Apr 28, 2026 · 8 min
Security

CVE-2025-61765: how we found it and what made the finding sticky

The zip-slip variant that survived a rename, a file-move, and a project restructure, thanks to a slice fingerprint.

Apr 14, 2026 · 6 min
Product

Honest labels: what "deterministic-core" and "oracle-passthrough" mean in practice

A plain-language explainer of the two finding partitions, written for the engineering leader who just got a scanipy report.

Apr 2, 2026 · 5 min
Research

Refactor-stable fingerprints: the normalisation passes that matter

α-renaming, PDG-only formatting normalisation, canonical topological sort, and extract/inline summary inlining, each explained with a before/after example.

Mar 19, 2026 · 11 min
Engineering

Multi-SCM parity: making GitHub, GitLab, Bitbucket and ADO return identical fingerprints

How we built the SCM connector abstraction and why the conformance test suite had to come before the connectors.

Mar 5, 2026 · 7 min
Security

SSRF in cloud-native services: the detection class we added in Stage A

Why SSRF is harder to detect than path traversal, and the IFDS spec changes that make it tractable.

Feb 20, 2026 · 8 min
Product

The honest-labeling ledger: a living document

Every claim in our architecture is tagged proven, empirical, staged, or not-claimed. Here is how to read it.

Feb 6, 2026 · 4 min
Engineering

Per-language CPG fidelity gates: what we measure and why

Parse success rate, call-edge precision/recall, PDG dependence-edge recall: the three numbers that gate a language into the Algorithm 2 benchmark.

Jan 23, 2026 · 6 min
Stay up to date

New posts, infrequently.

No newsletter cadence, no growth hacking. We write when we have something to say.