Scan, Patch, Re-Scan: Verifying AI Bug Fixes

说明与用途

扫描-修补-重新扫描循环为 AI 生成的修复提供独立验证，消除误报并创建确定性的 CI 检查点。

问题

AI assistants can propose code fixes but cannot reliably verify that the patch actually removes the vulnerability, leading to false confidence.

结果

The scan‑patch‑re‑scan loop ensures that AI‑generated fixes are independently verified, reducing false positives and providing deterministic build gates.

工作流

• Run BrassCoders offline scan to generate .brass/ai_instructions.yaml
• Open the YAML file with an AI assistant (e.g., Claude Code) to read findings and propose patches
• Apply the AI‑generated patch to the code
• Re‑run BrassCoders offline scan to verify the patch removed the finding
• If critical findings remain, fail the build or CI step

证据

BrassCoders re-scans the patched file with the same rules that produced the original finding, so the verification comes from a system that took no part in writing the fix.

来源

A 2025 benchmark, Large Language Models Versus Static Code Analysis Tools, ran three LLMs against three static analyzers on real vulnerabilities.

来源