CVE reachability with an LLM and a code graph

Asking a language model whether a CVE affects your code is easy. Deciding when not to believe the answer is the hard part. On one real project we started with a hundred critical CVEs and went through them by hand. Seven or eight out of ten could not be reached from our code. That ratio comes from one codebase, so treat it as an anecdote. Anyone... Weiterlesen: CVE reachability with an LLM and a code graph