AI assistants write Pydantic v2 models that pass mypy but accept invalid data. @validator decorators, orm_mode config, and missing strict=True slip through type checking. BrassCoders flags deprecated v1 patterns in v2 code via Semgrep, catching what static analysis misses. https://brss.fyi/198y

Pydantic v2 Validation Bugs AI Assistants Write

AI assistants write Pydantic v2 models that satisfy mypy but allow invalid data through, creating a false sense of API input validation security.

brss.fyi

MCP tool poisoning hides attack instructions in tool descriptions—invisible to static scanners. BrassCoders catches secrets and unsafe calls in handler code, but descriptions loaded at runtime need separate validation. Scan the code layer, audit the config layer. Read more → https://brss.fyi/tkvx

MCP Tool Poisoning: What Static Scanners Miss

Hidden instructions in MCP tool descriptions can hijack your AI coding agent. Here's the attack surface and what static analysis can and can't cover.

brss.fyi

Better AI models killed the obvious bugs. What survived: structural flaws buried in clean-looking code. 45% of AI-generated code still ships OWASP Top 10 vulnerabilities on first gen. Brasscoders catches what fluent models miss. Read more → https://brss.fyi/1trl

Why Better AI Models Make Bugs Harder to Catch

As AI coding assistants get better, the obvious bugs vanish and the structural ones hide inside code that looks too clean to question.

brss.fyi

OWASP's LLM Top 10 applies to agentic AI—but autonomous agents raise new risks. When Claude Code or Cursor writes Python, the code persists: hardcoded secrets, SQL injection, unsafe subprocess calls. BrassCoders scans for what AI agents structurally miss. Read more → https://brss.fyi/zyot

OWASP Agentic Top 10 for Python Developers

OWASP's agentic AI Top 10 covers risks Python developers face when using Claude Code, Cursor, or building autonomous AI coding pipelines.

brss.fyi

README files and code comments can steer Claude Code or Cursor into running attacker commands. Indirect prompt injection hides instructions in plain sight—OWASP LLM01. BrassCoders catches the generated code artifacts. pip install brasscoders → https://brss.fyi/1fey

Your README Is an Attack Surface for AI Agents

Hidden instructions in README files and code comments can steer Claude Code or Cursor into running attacker-controlled commands during a normal session.

brss.fyi

mypy says your code is clean. Then `None` arrives where you annotated `str`, and AttributeError hits production. AI-generated type hints pass static checks but fail at runtime — Optional masking required fields, Any collapsing structure, wrong return types. https://brss.fyi/adz3

AI Type Hints That Fool mypy and Break at Runtime

AI-generated type annotations pass mypy but fail at runtime — Optional masking required fields, Any collapsing structure, wrong return types.

brss.fyi

AI migrations fail silently in production. Adding NOT NULL columns without backfills, narrowing column types, SQLite-to-PostgreSQL type mismatches — AI assistants generate syntactically correct code that corrupts data. https://brss.fyi/jgrg

AI-Generated Migrations: The Data Loss Pattern

AI-generated Alembic and Django migrations have a specific failure pattern: column type mismatches and missing nullable defaults that corrupt data silently.

brss.fyi

AI code breaks in production because language models optimize for the prompt, not production constraints. Hardcoded localhost URLs, DEBUG = True, missing timeouts—they all pass local tests. BrassCoders flags these happy-path bugs before deploy. pip install brasscoders → https://brss.fyi/uhyg

Why AI Code Breaks in Production: The Happy-Path Bias

AI coding assistants optimize for the happy path: code that satisfies the prompt and passes local tests but breaks silently in production environments.

brss.fyi

AI pins real packages from training data—often versions 12-24 months old with known CVEs. pip-audit catches vulnerable versions in requirements.txt. BrassCoders catches the bugs your AI wrote in the code. Both belong in CI. Read more → https://brss.fyi/1e4q

AI-Generated requirements.txt and Vulnerable Packages

AI pins real packages but outdated vulnerable versions in requirements.txt — different from slopsquatting, and invisible without an explicit audit.

brss.fyi

AI writes tests that hit 80% coverage but assert almost nothing. Coverage theater looks clean in CI—the bug ships anyway. BrassCoders catches production-code bugs that coverage metrics miss: SQL injection, hardcoded secrets, phantom imports. Coverage tells you which lines ran. https://brss.fyi/30vq

Coverage Theater: AI Tests That Don't Test Anything

AI writes tests that hit 80% coverage but assert almost nothing — the pattern, why it happens, and what BrassCoders catches in the gap.

brss.fyi

Semgrep is a pattern-matching engine. BrassCoders bundles 12 scanners (including Semgrep) tuned for Python teams shipping AI code. Pick Semgrep if you write custom rules. Pick BrassCoders if you want deterministic detection out of the box. Read more → https://brss.fyi/1mka

Semgrep vs. BrassCoders: Choose the Right Tool

Semgrep and BrassCoders share a scanner. The useful question is what each adds that the other doesn't — for Python teams shipping AI-generated code.

brss.fyi

AI coders ship hardcoded secrets and SQL injection before you notice. BrassCoders runs 12 scanners as a pre-commit hook—blocks the commit before it hits git history. 5 lines of config. pip install brasscoders → https://brss.fyi/sm3y

Pre-Commit Hook That Stops AI-Coder Bugs

Set up BrassCoders as a pre-commit hook to block hardcoded secrets, SQL injection, and hallucinated imports before they hit your git history — 5 lines of config.

brss.fyi

Cloud code reviewers send your source to third parties on every commit. For HIPAA and SOC 2 teams, that's a compliance gap. Brasscoders runs locally, offline-first. Zero network calls. Catch what your AI coder misses → https://brss.fyi/1faq

HIPAA and SOC 2 Teams Can't Use Cloud Code Review

Cloud API code reviewers transmit your source code to third-party endpoints on every commit. For HIPAA and SOC 2 teams, that transmission creates a compliance gap BrassCoders's local scanner avoids entirely.

brss.fyi

AI generates the same five FastAPI security bugs repeatedly: SQL injection, hardcoded credentials, shell injection, hallucinated imports, O(N²) loops. Brasscoders catches them before they ship. pip install brasscoders → https://brss.fyi/cing

Five FastAPI Security Patterns AI Coders Get Wrong

AI coding assistants generate the same five FastAPI security mistakes across codebases. SQL injection, hardcoded credentials, shell injection, hallucinated packages, O(N²) loops — and how to catch them.

brss.fyi

BrassCoders and CodeRabbit do different jobs. One runs deterministically on every commit before a PR exists. The other reviews diffs conversationally when the PR opens. Most teams run both. Read more → https://brss.fyi/175w

BrassCoders vs CodeRabbit: Different Jobs

BrassCoders and CodeRabbit occupy different pipeline slots — one scans every commit deterministically before a PR exists, the other reviews the diff conversationally when the PR opens. Most teams run both.

brss.fyi

Auditors will ask about your AI code review process. Most teams wing it until 40% of the diff is AI-generated. A written policy gives you a standard to enforce and your auditor something to read. Brasscoders catches what your AI coder misses—use it in your gates. Read more → https://brss.fyi/dh22

AI Code Review Policy for Copilot Teams

A practical template for writing a code review policy when 40% of your diff is AI-generated. Covers pre-commit gates, CI enforcement, human review thresholds, and audit trails.

brss.fyi

AI coders ship code without a static gate. Claude Code, Cursor—fast, but no auto-run on push, no build failure on critical finds. BrassCoders in GitHub Actions closes that gap. Deterministic scan, every commit. pip install brasscoders → https://brss.fyi/11za

Add BrassCoders to GitHub Actions

Step-by-step guide to adding BrassCoders static analysis to your Python CI pipeline with GitHub Actions — copy-paste workflow, artifact upload, and build-failure configuration.

brss.fyi

1,500+ findings from a fresh brasscoders scan on a Django project. Most correct, most useless. .brassignore cuts signal to ~300 without touching settings. Test fixtures, migrations, vendor code — patterns worth ignoring. Read more → https://brss.fyi/1394

Tuning BrassCoders with .brassignore: From 1500 Findings to 300

A fresh brasscoders scan on a medium Django project produces 1500+ findings. .brassignore cuts that to ~300 signal findings without touching the Paid plan. Here's every pattern worth adding.

brss.fyi

Static analysis spits out 1500 findings. Without triage rules, teams either burn out fixing noise or ignore everything. Copper Sun Brass helps you sort signal from static: severity tiers, when to fix vs suppress, and how AI enrichment cuts false positives. Read more → https://brss.fyi/1lxa

Triaging Static Analysis Findings: A Practical Methodology

How to work through BrassCoders findings without burning out your team: severity tiers, when to fix vs suppress, .brassignore vs inline comments, and how AI enrichment changes the calculus.

brss.fyi

SonarQube tracks code quality over time. BrassCoders catches bugs AI coders introduce and feeds findings back to your AI assistant in YAML. Different layers, same problem. Both jobs are real. Read more → https://brss.fyi/3x53

SonarQube vs BrassCoders: Different Jobs, Different Layers

SonarQube is a code-quality workflow platform. BrassCoders is a focused AI-coder CI gate with YAML output for AI assistants. They solve different problems — here's when you need each, and when you need both.

brss.fyi

SOC 2 Type II needs proof you scan code, retain results, and act on findings. BrassCoders writes that proof to .brass/ on every commit—machine-readable evidence auditors want. Run it in CI, keep artifacts 90 days, you're covered. Read more → https://brss.fyi/x17n

Using BrassCoders for SOC 2 Audit Evidence: What the .brass/ Artifacts Prove

SOC 2 Type II requires evidence of continuous vulnerability monitoring. The .brass/detailed_analysis.yaml file — retained 90 days in CI artifacts — provides machine-readable evidence of what was scanned, when, and what was found.

brss.fyi

Snyk catches CVEs in dependencies. BrassCoders catches bugs in your code. Different files, different risks. A team running only one leaves half the problem unchecked. Read more → https://brss.fyi/r99x

Snyk vs BrassCoders: Dependency Scanning vs Source Code Scanning

Snyk catches CVEs in your dependencies. BrassCoders catches bugs in your source code. Different attack surfaces, different tools — here's when you need each.

brss.fyi

AI coders hallucinate packages. USENIX Security 2025: 19.7% of AI-recommended imports don't exist on PyPI. Attackers squat the names. Your pip install runs their code. Brasscoders detects phantom packages before they land in your repo. Read more → https://brss.fyi/1jht

Python Dependency Hallucination: Why AI Coders Invent Libraries That Don't Exist

USENIX Security 2025: 19.7% of AI-recommended packages don't exist. Lasso Security's PoC received 30,000+ downloads. How the PyPI attack surface works, and how BrassCoders's phantom-package scanner catches it before pip install runs.

brss.fyi

AI coders write Django code that runs but skips the security layer. Four patterns: raw() SQL injection, missing CSRF_COOKIE_SECURE, DEBUG=True in prod, unsafe mark_safe(). BrassCoders catches all four. Read more → https://brss.fyi/pa8j

Django Security Bugs AI Coders Write (And BrassCoders Catches)

Four Django security patterns AI coding assistants get wrong: SQL injection via raw(), missing CSRF_COOKIE_SECURE, DEBUG=True in production, and unsafe mark_safe(). Code examples and BrassCoders findings.

brss.fyi

45 sources across 8 categories on AI-code risk, CVE rates, and LLM limits. Every BrassCoders claim has a citation. Machine-readable JSON + llms.txt for AI assistants. Read more → https://brss.fyi/t4ds

BrassCoders Research Index Is Now Public on GitHub

The 45-source evidence base behind BrassCoders is now on GitHub: 8 research categories on AI-code risk, machine-readable JSON, and an llms.txt built for AI assistants.

brss.fyi

Cursor generates code fast. Reviewing it isn't. Run brasscoders, open .brass/ai_instructions.yaml in Cursor, ask it to triage findings. 12 deterministic scanners distilled into one structured file. Minutes instead of reading 2,000 raw outputs. Read more → https://brss.fyi/16av

BrassCoders + Cursor: Triage AI-Generated Code Findings in Minutes

Run brasscoders scan, open .brass/ai_instructions.yaml in Cursor, ask Cursor to triage. The workflow for reviewing AI-generated code without reading 1500 raw findings yourself.

brss.fyi

AI writes tests that pass CI but verify nothing: always-true assertions, empty test bodies, mock-everything. Green != tested. BrassCoders catches some patterns. Mutation testing catches the rest. Read more → https://brss.fyi/13no

AI-Generated Test Debt: Tests That Pass But Don't Test Anything

AI coding assistants write tests that pass CI but miss real bugs: always-true assertions, empty bodies, mock-everything tests. What BrassCoders catches and what requires mutation testing.

brss.fyi

Run brasscoders in GitLab CI to catch bugs before merge. Blocks MRs on failure, uploads .brass/ artifacts, works with Paid plan license keys. Full .gitlab-ci.yml config inside. Read more → https://brss.fyi/jezx

Add BrassCoders to GitLab CI: Full .gitlab-ci.yml Configuration

Add BrassCoders to your GitLab CI pipeline in under 10 minutes. Full .gitlab-ci.yml config, artifact upload, merge request gates, and Paid plan license key setup.

brss.fyi

11 of 12 bugs caught. That's BrassCoders vs Claude (12/12) vs Bandit (6/12) vs Pylint (1/12) on real AI-generated Python. The gap: BrassCoders is alone on cross-file taint, performance anti-patterns, hallucinated imports, and secrets. Read more → https://brss.fyi/10di

We Benchmarked BrassCoders Against a Frontier Model

Head-to-head on 12 AI-generated Python files: BrassCoders 11/12, Claude 12/12, Bandit 6/12, Pylint 1/12. What the numbers mean for your pre-merge workflow.

brss.fyi