Blog
Updates, technical deep-dives, and the occasional rant about vulnerability report quality.
60 Seconds of Silence: What the Production Startup Hang Taught Us
Update #14 — Every deploy was hanging silently for 60 seconds before being killed with nothing in the logs. The root cause, what the production DB confirmed, and the two-line fix.
VulnRap Now Speaks MCP: Triage From Inside Your Agent
Update #13 — VulnRap exposes its scoring, similarity, and diagnostics tooling over the Model Context Protocol so agents like Claude Desktop can triage reports without leaving the chat.
Under the Hood: Introducing the VulnRap Engine Deep-Dive Series
Update #11 — A guided tour through each scoring engine: what it measures, how it votes, and where the boundaries are.
Bring Your Own Fixtures: Validating VulnRap Against Your Corpus
Update #10 — Run VulnRap's scoring pipeline against your own labelled reports and compare precision/recall on your data.
Showing Our Work: Per-Signal Precision/Recall in the UI
Update #9 — Every signal now surfaces its own precision and recall numbers so you can see exactly which detectors pull their weight.
Three Ways Slop Hid This Sprint (And How the Audit Caught Them)
Sprint 14 — Three classes of slop slipped past the scorer this sprint. Here is how the disagreement-floor audit, response-body strip-and-retest, and ARM64 register-dump detector pulled them back into the red zone.
Closing the Slop Gap: Engine 3 Now Cross-Checks Engine 2 Before It Votes
Sprint 12 — The substance LLM now refuses to outvote the heuristic on evidence-free reports.
AVRI: One Rubric Wasn't Enough — Why v3.7.0 Scores Memory Bugs and XSS Slop on Different Yardsticks
Sprint 11 — The Adversarial Vulnerability Report Index splits scoring by family so a memory-corruption report and an XSS report no longer share the same gold-signal yardstick.
v3.5.0 Field Test: Three Engines, Seven Reports, and a Ceiling We Didn't Expect
Field test of v3.5.0 across seven real-world reports surfaced a scoring ceiling we did not predict. What the three engines agreed on, where they disagreed, and what the next sprint changes.
460K Vulnerability Reports, 56 Sources, and a 0% Detection Rate
The week we built the most diverse vulnerability report dataset we could find, ran our scoring system against it, and watched it score AI slop and real CVEs identically.
The Data Is There, the Score Isn't Listening
Sprint 8 results: the pipeline finally works, substance detection is live, and the scoring formula mathematically cannot use it.
Grading AI with AI: What We Learned When Our Detection Model Met the Real World
Six development sprints, a 20% real-world detection rate, and the fundamental rethinking that led us from style detection to substance verification.
Building VulnRap: How We're Making Vulnerability Report Validation Actually Work for PSIRT Teams
A detailed walkthrough of four development sprints, what we built, what we learned, what works, and what's coming next.
We Built the Tool We Wished Existed
Why we created VulnRap, how it helps with triage, and why you should feel comfortable using it.
Follow the project on GitHub to stay updated.