Scan, Patch, Re-Scan: Verifying AI Bug Fixes

Описание и применение

Петля сканирование‑патч‑повторное сканирование обеспечивает независимую проверку исправлений, предложенных ИИ, устраняя ложные срабатывания и создавая детерминированные проверки в CI.

Задача

AI assistants can propose code fixes but cannot reliably verify that the patch actually removes the vulnerability, leading to false confidence.

Результат

The scan‑patch‑re‑scan loop ensures that AI‑generated fixes are independently verified, reducing false positives and providing deterministic build gates.

Рабочий процесс

• Run BrassCoders offline scan to generate .brass/ai_instructions.yaml
• Open the YAML file with an AI assistant (e.g., Claude Code) to read findings and propose patches
• Apply the AI‑generated patch to the code
• Re‑run BrassCoders offline scan to verify the patch removed the finding
• If critical findings remain, fail the build or CI step

Доказательства

BrassCoders re-scans the patched file with the same rules that produced the original finding, so the verification comes from a system that took no part in writing the fix.

Источник

A 2025 benchmark, Large Language Models Versus Static Code Analysis Tools, ran three LLMs against three static analyzers on real vulnerabilities.

Источник