Issues

Reasoning models exhaust the fixed output budgets: app-context max_tokens=2000 and report max_tokens=4096 produce fence-only/empty completions on glm-5.3

#512

· gadievron opened

on Sep 5, 2026

Two real-but-cosmetic dead-code findings from the review-bot corpus (re-adjudicated): scanner.py's dataset dead store; _TEST_FILES_SKIPPED_KEY unused

#507

· gadievron opened

on Sep 5, 2026

Entry-point seeding heuristic: the file-reading regexes miss pathlib BinOp forms and mode-less open() — under-seeds in the FN-unsafe direction

#506

· gadievron opened

on Sep 5, 2026

tempfile.mkdtemp() in tests: 116 unmanaged sites across 89 files (~3 with cleanup) — permanent tmp accumulation; tmp_path already the majority idiom

#505

· gadievron opened

on Sep 5, 2026

Tests-tree text I/O without explicit encoding= (787 sites) — a Windows/cp1252 latent class; prod's own open_utf8 reader unused by tests

#504

· gadievron opened

on Sep 5, 2026

The Python html report (report/html_report.py) still loads Chart.js from the CDN — the #332 self-containment contract covers only the Go-rendered reports

#502

· gadievron opened

on Sep 5, 2026

Dynamic-test runtime: Python base image is LLM-chosen with no anchor; Go is prompt-pinned to golang:1.25-alpine — decide the runtime policy

#412

· gadievron opened

on Aug 29, 2026

`_has_conclusive_exploit_path` tests a free-text explanation string, so an incomplete verification suppresses a correction — its mirror guard must NOT be tightened (PR #195/#243)

#296

· gadievron opened

on Aug 20, 2026

Should a language pinned in a stored `project.json` be promoted to a user-typed `-l`? (policy + migration of already-stored pins)

#274

· gadievron opened

on Aug 18, 2026

Dependency Dashboard

#265

· knostic-renovate opened

on Aug 18, 2026

Navigation Menu

Uh oh!

All issues

Reasoning models exhaust the fixed output budgets: app-context max_tokens=2000 and report max_tokens=4096 produce fence-only/empty completions on glm-5.3

Two real-but-cosmetic dead-code findings from the review-bot corpus (re-adjudicated): scanner.py's dataset dead store; _TEST_FILES_SKIPPED_KEY unused

Entry-point seeding heuristic: the file-reading regexes miss pathlib BinOp forms and mode-less open() — under-seeds in the FN-unsafe direction

tempfile.mkdtemp() in tests: 116 unmanaged sites across 89 files (~3 with cleanup) — permanent tmp accumulation; tmp_path already the majority idiom

Tests-tree text I/O without explicit encoding= (787 sites) — a Windows/cp1252 latent class; prod's own open_utf8 reader unused by tests

The Python html report (report/html_report.py) still loads Chart.js from the CDN — the #332 self-containment contract covers only the Go-rendered reports

Dynamic-test runtime: Python base image is LLM-chosen with no anchor; Go is prompt-pinned to golang:1.25-alpine — decide the runtime policy

`_has_conclusive_exploit_path` tests a free-text explanation string, so an incomplete verification suppresses a correction — its mirror guard must NOT be tightened (PR #195/#243)

Should a language pinned in a stored `project.json` be promoted to a user-typed `-l`? (policy + migration of already-stored pins)

Dependency Dashboard

Uh oh!

Search results