Long-form, cited, practical guides for engineers shipping AI-augmented code. Each guide is a pillar — full coverage of one topic, linked from the related blog posts that go deeper on specific failure modes.
The seven categories of bug AI coding assistants systematically miss — cross-file taint, hardcoded credentials, hallucinated imports, race conditions, context-dependent insecure patterns, auth middleware gaps, and PII flows. Cited research, worked examples, the deterministic complement for each.
Read guide
The capability map of every detector BrassCoders runs: six bundled OSS engines (Bandit, Pylint, Pyre/Pysa, Semgrep, ast-grep, detect-secrets) plus six custom detectors (phantom imports, performance anti-patterns, extended secret formats, PII, content moderation, JS/TS) — what each finds, and where the deterministic layer hands off to your AI assistant.
Read guide
The curated reference index for the AI-code-quality problem. Papers, industry reports, OSS tools, and benchmark repos — each with a BrassCoders capsule explaining what builders should actually do with it. Five problem-led categories, quarterly refresh.
Read guide
A practical guide to reviewing AI-generated code without burnout. Covers the four failure modes of AI-assisted PRs (noise, secret leakage, hallucinated imports, diff complexity), the workflow that scales, and how to combine static analysis with LLM-based review.
Read guide
Honest comparison of open-source and commercial SAST tools. Three architectural patterns (rule-based, dataflow, AST-plus-context), real cost trade-offs, and a decision matrix matching the stack to your team size.
Read guide
Step-by-step setup from a fresh machine to a working CI integration. Install, first scan, AI assistant hand-off, GitHub Actions / GitLab CI examples, Paid plan activation, and .brassignore configuration tips.
Read guide
The four scanner categories that cover AI-generated Python — security (Bandit, Pyre/Pysa, Semgrep), performance anti-patterns, secrets/PII, and correctness — with real catch-rate benchmark data and a single-command setup that bundles all 12 scanners.
Read guide
How to build a three-stage code gate pipeline: pre-commit hook for local blocking, GitHub Actions CI scan for automated enforcement, and branch protection merge gate. Includes full YAML configuration, audit trail setup, and AI-assistant triage workflow.
Read guide
How to feed structured BrassCoders findings to Claude Code, Cursor, and Continue so your AI assistant triages instead of guessing. Covers the .brass/ai_instructions.yaml file, severity ordering, line anchoring, and the research case for a deterministic pre-pass.
Read guide
The vulnerability classes AI coding assistants produce — SQL injection via f-strings, command injection via shell=True, hardcoded credentials, unsafe deserialization — with corpus evidence, BrassCoders catch data, and the argument for a deterministic gate over an LLM reviewer.
Read guide
The two ways to scan every commit — a CI step on push (GitHub Actions or GitLab CI) or a git pre-commit hook — plus why there is no automatic watch mode (the watch command was removed in 2.0.9) and how the exit code gates the build.
Read guide
More guides in development. Subscribe via RSS or check back as the library grows.