Engineering blog
Architecture deep-dives, benchmark methodology, and product updates from the team building TheAuditor, deterministic code context and polyglot SAST for AI agents.
In July we said the release was measured in days. Then we removed 62,585 net lines and rebuilt the core. Here is what 'done' actually means here, and why it is a scorecard rather than a ship date.
Read post →
The industry writes the same rule once per language: N weaknesses times M languages, maintained forever. We replaced that with one system that classifies against the public standards, so coverage grows by addition instead of by copy-paste.
Read post →
A long list of supported languages means nothing if half of them get a shallow pass. C and Solidity now get the same cross-file, source-to-sink treatment as our strongest lanes, and the analysis follows data into the infrastructure around them.
Read post →
Most scanners return 'no findings' whether your code is clean or the tool simply could not analyze it. Those are opposite facts wearing the same output. We rebuilt so the tool tells you which one you are looking at, and grades its own work on every run.
Read post →
The week we said the release was measured in days, we deleted the entire rules engine: 94,013 lines in a single commit, with nothing staged to replace it. Here is why we tore down the thing every SAST tool ships.
Read post →
TheAuditor 5.0 is in final commercial release preparation, with public availability planned for early August 2026. Here is the product promise and the internal 87% token-use result we intend to prove in the field.
Read post →
Agents burn their context budget reading whole files to answer questions a query could answer. TheAuditor hands them verified facts instead, so they stop guessing about code they never fully see.
Read post →
We pushed taint analysis deeper and are publishing the hard recall and precision numbers, not a mechanism walkthrough. Rust injection coverage is now at parity with our strongest languages, and Bash lost a class of false positives.
Read post →
The Windows and Linux binaries now produce byte-for-byte identical output across every test corpus, so a finding on your laptop is provably the same finding in CI and on a teammate's machine.
Read post →
A closed binary in your build is a fair thing to worry about. Here is the checklist a trustworthy closed-source scanner should meet, and how TheAuditor meets every item.
Read post →
TheAuditor's incremental scan now returns the same findings as a full scan, cross-file calls included. Run the fast one on every commit and trust it.
Read post →
Enterprise procurement wants a bill of materials and a clean license story before you get in the door. TheAuditor now ships both: a signed component inventory and a copyleft-free build.
Read post →
Version 5.0.0 turns TheAuditor into a release line you can trust. Every build stamps the exact commit and build time it came from, the analysis ships as a sealed, encrypted artifact, and the same adversarial scans run against the binary before it leaves the door.
Read post →
TheAuditor 5.0.0 wires its index into MCP, so an AI agent working in your repo asks structured questions (which handler serves this route, where a value comes from and goes, what's security-relevant here) and gets deterministic answers instead of a pile of files to re-read.
Read post →
TheAuditor's live-host scanner reads operational context like backported kernels, ufw rules, container limits, and nginx redirects, so its findings are accurate instead of noisy. And it never drops a result silently.
Read post →
AI agents hallucinate because they guess. TheAuditor hands them deterministic facts, and wired into the full stack, it makes file-reading agents and self-graded SAST look like relics.
Read post →
Days from public launch, we pointed our own SAST at the license server we ship on. 204 findings, 0 launch-blockers, and the false-positive rate became the next product release.
Read post →
Application code and infrastructure code live in different repos, get scanned by different tools, and stay disconnected. Then the bash script that bridges them quietly passes a tainted value into terraform apply -var.
Read post →
Every commercial SAST tool stops at the exec call. Ours doesn't. Here is what tracing a single piece of user input across multiple languages actually looks like.
Read post →
AI agents waste tokens, hallucinate relationships, and miss cross-language flows because they read files instead of querying facts. We built the database that fixes it, and the MCP server that exposes it.
Read post →
Provider freedom and serious token economics from Warden. Verified-fact code intelligence from TheAuditor. Why the pairing isn't a coincidence.
Read post →