Notes on AI code review noise filtering, static analysis, and shipping cleaner code with Claude Code / Cursor.https://coppersun.dev/en-ushttps://coppersun.dev/blog/ai-code-license-risk-memorization/https://coppersun.dev/blog/ai-code-license-risk-memorization/AI coding assistants can reproduce license-encumbered training data. Here is what the memorization research, GitHub's own data, and an active lawsuit say.Fri, 04 Sep 2026 00:00:00 GMTprivacyengineeringCopper Sun Brass Teamhttps://coppersun.dev/blog/deserialization-cves-ai-ml-python-2026/https://coppersun.dev/blog/deserialization-cves-ai-ml-python-2026/PyYAML's yaml.load carried a CVSS 9.8 CVE. PyTorch's torch.load carried one at 9.3, in 2025, in a flag documented as safe. Here is the actual track record.Fri, 04 Sep 2026 00:00:00 GMTsecurityengineeringCopper Sun Brass Teamhttps://coppersun.dev/blog/idor-access-control-by-the-numbers/https://coppersun.dev/blog/idor-access-control-by-the-numbers/OWASP ranks broken access control the top web risk and BOLA the top API risk. Real prevalence and attack data, and what BrassCoders can honestly flag.Fri, 04 Sep 2026 00:00:00 GMTsecuritybenchmarksCopper Sun Brass Teamhttps://coppersun.dev/blog/redos-ai-generated-regex/https://coppersun.dev/blog/redos-ai-generated-regex/Catastrophic backtracking turns one crafted input into a denial-of-service attack: real npm advisories and how to catch it before it ships.Fri, 04 Sep 2026 00:00:00 GMTsecurityengineeringCopper Sun Brass Teamhttps://coppersun.dev/blog/ai-code-defect-rates-q3-2026/https://coppersun.dev/blog/ai-code-defect-rates-q3-2026/A dated, sourced snapshot of AI-generated-code defect and security rates for Q3 2026: 45% OWASP flaws, 1.7x issues per PR, 19.7% phantom packages. Refreshed quarterly.Sat, 29 Aug 2026 00:00:00 GMTbenchmarkssecurityai-code-reviewCopper Sun Brass Teamhttps://coppersun.dev/blog/ai-package-hallucination-data/https://coppersun.dev/blog/ai-package-hallucination-data/BrassCoders ran a first-party probe: 96 package names a frontier AI model suggested for Python tasks, checked live against PyPI. 95 existed; 1 didn't.Sat, 29 Aug 2026 00:00:00 GMTsecuritybenchmarkshallucinationsupply-chainCopper Sun Brass Teamhttps://coppersun.dev/blog/brasscoders-claude-code-hook/https://coppersun.dev/blog/brasscoders-claude-code-hook/Wire a Claude Code hook to run brasscoders scan on every edit, so .brass/ai_instructions.yaml stays fresh and the assistant reads findings without copy-paste.Sat, 29 Aug 2026 00:00:00 GMTai-code-reviewworkflowoss-coreCopper Sun Brass Teamhttps://coppersun.dev/blog/llm-code-reviewer-reliability-data/https://coppersun.dev/blog/llm-code-reviewer-reliability-data/A 2025 benchmark puts LLM code-review recall at 0.78 to 0.88, yet the models mislocate findings and vary run to run — the numbers on why it's a weak gate.Sat, 29 Aug 2026 00:00:00 GMTai-code-reviewbenchmarksengineeringCopper Sun Brass Teamhttps://coppersun.dev/blog/scan-patch-verify-ai-bugs/https://coppersun.dev/blog/scan-patch-verify-ai-bugs/BrassCoders closes the loop on AI-written bugs: scan for the finding, hand it to your assistant for a patch, then re-scan to confirm the fix deterministically.Sat, 29 Aug 2026 00:00:00 GMTai-code-reviewoss-coreengineeringCopper Sun Brass Teamhttps://coppersun.dev/blog/express-security-ai-generated-nodejs/https://coppersun.dev/blog/express-security-ai-generated-nodejs/BrassCoders scans an AI-generated Express.js user API and returns CRITICAL command injection plus a hardcoded JWT secret. Real scan output and fixes.Fri, 28 Aug 2026 00:00:00 GMTsecurityai-code-reviewengineeringCopper Sun Brass Teamhttps://coppersun.dev/blog/ai-coding-tools-security-risk-engineering-leaders/https://coppersun.dev/blog/ai-coding-tools-security-risk-engineering-leaders/What three 2025 studies show about AI-generated code security, why the risk compounds, and how to build a deterministic scanning gate.Fri, 21 Aug 2026 00:00:00 GMTsecurityai-code-reviewengineeringCopper Sun Brass Teamhttps://coppersun.dev/blog/business-logic-bugs-static-analysis/https://coppersun.dev/blog/business-logic-bugs-static-analysis/AI generates code that satisfies the prompt — not the business rules it was never given. Static analysis can't catch what only your requirements document knows.Fri, 21 Aug 2026 00:00:00 GMTsecurityai-code-reviewengineeringCopper Sun Brass Teamhttps://coppersun.dev/blog/trust-boundary-problem-ai-code/https://coppersun.dev/blog/trust-boundary-problem-ai-code/When AI-generated code is 'safe' but wrong: the trust boundary is a design decision no scanner can make. Here's what it means and what actually enforces it.Fri, 21 Aug 2026 00:00:00 GMTsecurityai-code-reviewengineeringCopper Sun Brass Teamhttps://coppersun.dev/blog/run-brasscoders-on-every-commit/https://coppersun.dev/blog/run-brasscoders-on-every-commit/A new guide covers how to run BrassCoders on every commit — a CI step on push or a git pre-commit hook — and why there's no automatic watch mode. BrassCoders is a command-line scanner you invoke, not a background daemon.Wed, 19 Aug 2026 00:00:00 GMToss-coreci-cdai-code-reviewCopper Sun Brass Teamhttps://coppersun.dev/blog/ai-coding-assistant-vendor-risk-questions/https://coppersun.dev/blog/ai-coding-assistant-vendor-risk-questions/Evaluating an AI coding assistant for your team? Two separate surfaces require two separate question sets. Here's the checklist for both.Fri, 14 Aug 2026 00:00:00 GMTsecuritycomplianceengineeringCopper Sun Brass Teamhttps://coppersun.dev/blog/b608-sql-injection-fix-walkthrough/https://coppersun.dev/blog/b608-sql-injection-fix-walkthrough/Before-and-after walkthrough: BrassCoders finds SQL injection in a corpus Flask endpoint, the parameterized fix, and what the re-scan shows — including the one Semgrep taint finding that remains.Fri, 14 Aug 2026 00:00:00 GMTsecurityai-code-reviewoss-coreCopper Sun Brass Teamhttps://coppersun.dev/blog/brassignore-tune-false-positives/https://coppersun.dev/blog/brassignore-tune-false-positives/BrassCoders flags MD5 in a file-deduplication script as a CRITICAL security finding. The pattern match is correct — the context makes it a false positive. Here's the before scan, the .brassignore entry, and the after scan.Fri, 14 Aug 2026 00:00:00 GMToss-coreai-code-reviewengineeringCopper Sun Brass Teamhttps://coppersun.dev/blog/business-case-ai-code-scanning/https://coppersun.dev/blog/business-case-ai-code-scanning/How to frame the ROI of adding AI-aware static analysis to your team's CI pipeline — anchored in your own scan data, not vendor-provided numbers.Fri, 14 Aug 2026 00:00:00 GMTai-code-reviewsecurityengineeringCopper Sun Brass Teamhttps://coppersun.dev/blog/hardcoded-token-fix-walkthrough/https://coppersun.dev/blog/hardcoded-token-fix-walkthrough/A real before-and-after: BrassCoders's SecretsScanner finds a hardcoded HMAC signing key in a corpus Python file. The environment variable fix, the re-scan, and why detect-secrets catches this where Bandit alone misses some cases.Fri, 14 Aug 2026 00:00:00 GMTsecurityai-code-reviewoss-coreCopper Sun Brass Teamhttps://coppersun.dev/blog/quantifying-ai-code-risk-engineering-leaders/https://coppersun.dev/blog/quantifying-ai-code-risk-engineering-leaders/AI coding assistants expand code output without expanding review capacity. A practical framework for measuring AI-generated code security risk as a number your organization can act on.Fri, 14 Aug 2026 00:00:00 GMTai-code-reviewsecurityengineeringCopper Sun Brass Teamhttps://coppersun.dev/blog/security-manager-brief-ai-generated-code-risk/https://coppersun.dev/blog/security-manager-brief-ai-generated-code-risk/A concise brief on what AI coding assistants do to your security surface, what conventional tooling misses, and what one CI step closes the gap.Fri, 14 Aug 2026 00:00:00 GMTsecurityai-code-reviewengineeringCopper Sun Brass Teamhttps://coppersun.dev/blog/what-static-analysis-cannot-see/https://coppersun.dev/blog/what-static-analysis-cannot-see/SQL injection: caught. Missing auth on a route: not caught. BrassCoders maps the precise boundary between what static analysis detects deterministically and what requires an AI assistant's context.Fri, 14 Aug 2026 00:00:00 GMToss-coreai-code-reviewsecurityCopper Sun Brass Teamhttps://coppersun.dev/blog/what-to-ask-static-analysis-vendor-ai-code/https://coppersun.dev/blog/what-to-ask-static-analysis-vendor-ai-code/Generic static analysis tools have a coverage gap specific to AI-generated code. These questions separate AI-aware tools from legacy scanners in a vendor evaluation.Fri, 14 Aug 2026 00:00:00 GMTsecurityai-code-reviewengineeringCopper Sun Brass Teamhttps://coppersun.dev/blog/brasscoders-nodejs-typescript-coverage/https://coppersun.dev/blog/brasscoders-nodejs-typescript-coverage/Yes — via a dedicated Babel-based JavaScript/TypeScript scanner and Semgrep. Here's exactly what it catches and where the gap is versus the Python scanner.Fri, 07 Aug 2026 00:00:00 GMToss-coreengineeringCopper Sun Brass Teamhttps://coppersun.dev/blog/brasscoders-race-conditions-async-python/https://coppersun.dev/blog/brasscoders-race-conditions-async-python/Partially. BrassCoders catches structural indicators — threading.Thread without locks, shared mutable state in async functions — but not asyncio races that leave no structural marker.Fri, 07 Aug 2026 00:00:00 GMTengineeringai-code-reviewCopper Sun Brass Teamhttps://coppersun.dev/blog/can-i-run-brasscoders-offline/https://coppersun.dev/blog/can-i-run-brasscoders-offline/BrassCoders's OSS core makes zero outbound calls by default. The --offline flag adds hard enforcement for air-gapped CI, HIPAA, and SOC 2 environments.Fri, 07 Aug 2026 00:00:00 GMToss-coreengineeringCopper Sun Brass Teamhttps://coppersun.dev/blog/cost-sql-injection-ai-generated-code/https://coppersun.dev/blog/cost-sql-injection-ai-generated-code/Detection time, remediation effort, credential rotation, and incident response — framed in engineering hours, not dollar amounts. And what catching it at commit time costs instead.Fri, 07 Aug 2026 00:00:00 GMTsecurityengineeringCopper Sun Brass Teamhttps://coppersun.dev/blog/does-brasscoders-work-with-django-rest-framework/https://coppersun.dev/blog/does-brasscoders-work-with-django-rest-framework/Yes — BrassCoders scans DRF views, serializers, and settings files. Semgrep includes Django-specific rules, and Bandit catches SQL injection and secrets in DRF route handlers.Fri, 07 Aug 2026 00:00:00 GMToss-coresecurityCopper Sun Brass Teamhttps://coppersun.dev/blog/does-brasscoders-work-with-pyproject-toml/https://coppersun.dev/blog/does-brasscoders-work-with-pyproject-toml/Yes — BrassCoders scans any Python project layout. It reads pyproject.toml as the project manifest for Paid-plan enrichment and works with both pyproject.toml and setup.py projects.Fri, 07 Aug 2026 00:00:00 GMToss-coreengineeringCopper Sun Brass Teamhttps://coppersun.dev/blog/first-brasscoders-scan-ai-python/https://coppersun.dev/blog/first-brasscoders-scan-ai-python/Step-by-step: install BrassCoders, run the scan, read the .brass/ai_instructions.yaml output, and understand what to do with the findings.Fri, 07 Aug 2026 00:00:00 GMToss-coreengineeringCopper Sun Brass Teamhttps://coppersun.dev/blog/how-do-i-read-brass-ai-instructions-yaml/https://coppersun.dev/blog/how-do-i-read-brass-ai-instructions-yaml/After a BrassCoders scan, .brass/ai_instructions.yaml contains severity-ranked findings formatted for pasting into Claude Code or Cursor. Here's how to read and use it.Fri, 07 Aug 2026 00:00:00 GMToss-coreai-code-reviewCopper Sun Brass Teamhttps://coppersun.dev/blog/how-long-does-a-brasscoders-scan-take/https://coppersun.dev/blog/how-long-does-a-brasscoders-scan-take/A typical BrassCoders scan runs in under 60 seconds on most Python codebases. Scan time scales with project size and whether Pyre/Pysa taint analysis is enabled.Fri, 07 Aug 2026 00:00:00 GMToss-coreengineeringCopper Sun Brass Teamhttps://coppersun.dev/blog/what-does-a-brasscoders-scan-output-look-like/https://coppersun.dev/blog/what-does-a-brasscoders-scan-output-look-like/BrassCoders writes three YAML files to .brass/ — a ranked AI instructions file, a full findings file, and a security-only view. Here's what each contains.Fri, 07 Aug 2026 00:00:00 GMToss-coreai-code-reviewCopper Sun Brass Teamhttps://coppersun.dev/blog/what-python-versions-does-brasscoders-support/https://coppersun.dev/blog/what-python-versions-does-brasscoders-support/BrassCoders requires Python 3.10 or higher. It runs on macOS, Linux, and Windows via WSL2. Python 3.9 and earlier are not supported due to Pyre/Pysa requirements.Fri, 07 Aug 2026 00:00:00 GMToss-coreengineeringCopper Sun Brass Teamhttps://coppersun.dev/blog/what-is-the-difference-between-brassignore-and-gitignore/https://coppersun.dev/blog/what-is-the-difference-between-brassignore-and-gitignore/.gitignore tells git which files to exclude from version control. .brassignore tells BrassCoders which files or finding types to suppress — a different job, a different syntax.Fri, 07 Aug 2026 00:00:00 GMToss-coreengineeringCopper Sun Brass Teamhttps://coppersun.dev/blog/ai-code-happy-path-bias-production-bugs/https://coppersun.dev/blog/ai-code-happy-path-bias-production-bugs/AI coding assistants optimize for the happy path: code that satisfies the prompt and passes local tests but breaks silently in production environments.Mon, 03 Aug 2026 00:00:00 GMTengineeringai-code-reviewoss-coreCopper Sun Brass Teamhttps://coppersun.dev/blog/ai-generated-migrations-data-loss-bugs/https://coppersun.dev/blog/ai-generated-migrations-data-loss-bugs/AI-generated Alembic and Django migrations have a specific failure pattern: column type mismatches and missing nullable defaults that corrupt data silently.Mon, 03 Aug 2026 00:00:00 GMTengineeringai-code-reviewoss-coreCopper Sun Brass Teamhttps://coppersun.dev/blog/ai-generated-requirements-txt-vulnerable-packages/https://coppersun.dev/blog/ai-generated-requirements-txt-vulnerable-packages/AI pins real packages but outdated vulnerable versions in requirements.txt — different from slopsquatting, and invisible without an explicit audit.Mon, 03 Aug 2026 00:00:00 GMTsecurityai-code-reviewengineeringCopper Sun Brass Teamhttps://coppersun.dev/blog/ai-type-hints-fool-mypy-runtime-bugs/https://coppersun.dev/blog/ai-type-hints-fool-mypy-runtime-bugs/AI-generated type annotations pass mypy but fail at runtime — Optional masking required fields, Any collapsing structure, wrong return types.Mon, 03 Aug 2026 00:00:00 GMTengineeringai-code-reviewoss-coreCopper Sun Brass Teamhttps://coppersun.dev/blog/coverage-theater-ai-generated-tests/https://coppersun.dev/blog/coverage-theater-ai-generated-tests/AI writes tests that hit 80% coverage but assert almost nothing — the pattern, why it happens, and what BrassCoders catches in the gap.Mon, 03 Aug 2026 00:00:00 GMTengineeringai-code-reviewoss-coreCopper Sun Brass Teamhttps://coppersun.dev/blog/mcp-tool-poisoning-what-static-scanners-miss/https://coppersun.dev/blog/mcp-tool-poisoning-what-static-scanners-miss/Hidden instructions in MCP tool descriptions can hijack your AI coding agent. Here's the attack surface and what static analysis can and can't cover.Mon, 03 Aug 2026 00:00:00 GMTsecurityai-code-reviewengineeringCopper Sun Brass Teamhttps://coppersun.dev/blog/owasp-agentic-top-10-python-developers/https://coppersun.dev/blog/owasp-agentic-top-10-python-developers/OWASP's agentic AI Top 10 covers risks Python developers face when using Claude Code, Cursor, or building autonomous AI coding pipelines.Mon, 03 Aug 2026 00:00:00 GMTsecurityai-code-reviewengineeringCopper Sun Brass Teamhttps://coppersun.dev/blog/pydantic-v2-validation-bugs-ai-generated-apis/https://coppersun.dev/blog/pydantic-v2-validation-bugs-ai-generated-apis/AI assistants write Pydantic v2 models that satisfy mypy but allow invalid data through, creating a false sense of API input validation security.Mon, 03 Aug 2026 00:00:00 GMTsecurityai-code-reviewengineeringCopper Sun Brass Teamhttps://coppersun.dev/blog/readme-prompt-injection-ai-coding-agents/https://coppersun.dev/blog/readme-prompt-injection-ai-coding-agents/Hidden instructions in README files and code comments can steer Claude Code or Cursor into running attacker-controlled commands during a normal session.Mon, 03 Aug 2026 00:00:00 GMTsecurityai-code-reviewengineeringCopper Sun Brass Teamhttps://coppersun.dev/blog/what-ai-coding-agents-leave-in-production/https://coppersun.dev/blog/what-ai-coding-agents-leave-in-production/print() calls, commented-out auth checks, and debug flags — the artifacts AI coding assistants leave that consistently survive code review.Mon, 03 Aug 2026 00:00:00 GMTsecurityai-code-reviewengineeringCopper Sun Brass Teamhttps://coppersun.dev/blog/ruff-wont-catch-security-bugs/https://coppersun.dev/blog/ruff-wont-catch-security-bugs/Ruff's default ruleset covers style and correctness — not security. Here's what to add to Ruff, and what neither Ruff nor Bandit covers in AI-generated Python.Sat, 01 Aug 2026 00:00:00 GMTcomparisonsecurityoss-coreCopper Sun Brass Teamhttps://coppersun.dev/blog/ai-code-security-scanners-compared/https://coppersun.dev/blog/ai-code-security-scanners-compared/BrassCoders, Snyk, Semgrep, SonarQube, and CodeRabbit each occupy a different pipeline slot. Here's how to map them to your CI workflow.Fri, 31 Jul 2026 00:00:00 GMTcomparisonsecurityai-code-reviewCopper Sun Brass Teamhttps://coppersun.dev/blog/agentic-code-security-autonomous-ai/https://coppersun.dev/blog/agentic-code-security-autonomous-ai/Autonomous coding agents ship code without a human in the review loop. BrassCoders scans the output regardless of authorship — here's what the patterns look like.Wed, 22 Jul 2026 00:00:00 GMTsecurityai-code-reviewengineeringCopper Sun Brass Teamhttps://coppersun.dev/blog/ai-code-policy-regulated-industries/https://coppersun.dev/blog/ai-code-policy-regulated-industries/Regulatory frameworks were written before AI coding assistants existed. Here's which existing obligations apply — and what evidence record satisfies them for the code-review step.Wed, 22 Jul 2026 00:00:00 GMTsecuritycomplianceengineeringCopper Sun Brass Teamhttps://coppersun.dev/blog/ai-code-review-policy-template/https://coppersun.dev/blog/ai-code-review-policy-template/A complete, section-by-section AI code review policy template for engineering teams — covering the technical gate, human review requirements, secrets handling, and escalation paths.Wed, 22 Jul 2026 00:00:00 GMTengineeringai-code-reviewoss-coreCopper Sun Brass Teamhttps://coppersun.dev/blog/async-race-conditions-ai-generated-python/https://coppersun.dev/blog/async-race-conditions-ai-generated-python/AI assistants generate async Python that shares mutable state without locking — the prompt asked for performance, not safety. Here's exactly what breaks and how to fix it.Wed, 22 Jul 2026 00:00:00 GMTsecurityengineeringai-code-reviewCopper Sun Brass Teamhttps://coppersun.dev/blog/brasscoders-scans-llm-application-code/https://coppersun.dev/blog/brasscoders-scans-llm-application-code/BrassCoders applies 12 scanners to LLM application code. What changes isn't the scanner — it's which findings dominate: hardcoded API keys, missing input validation before prompt templates, and SQL/shell injection through tool calls.Wed, 22 Jul 2026 00:00:00 GMTsecurityai-code-reviewoss-coreCopper Sun Brass Teamhttps://coppersun.dev/blog/flask-security-ai-coders/https://coppersun.dev/blog/flask-security-ai-coders/Four Flask security patterns AI coding assistants get wrong: missing CSRF protection, debug=True in production, hardcoded secret_key, and SQL injection via f-string. Verified Bandit rule IDs included.Wed, 22 Jul 2026 00:00:00 GMTsecurityai-code-reviewbenchmarksCopper Sun Brass Teamhttps://coppersun.dev/blog/gdpr-ai-code-data-handling/https://coppersun.dev/blog/gdpr-ai-code-data-handling/GDPR Article 25 requires privacy by design. BrassCoders's --offline flag delivers it: zero bytes leave the machine during an OSS scan. Here's how that maps to your GDPR obligations.Wed, 22 Jul 2026 00:00:00 GMTsecuritycomplianceoss-coreCopper Sun Brass Teamhttps://coppersun.dev/blog/mass-assignment-ai-generated-api/https://coppersun.dev/blog/mass-assignment-ai-generated-api/AI assistants write FastAPI endpoints that blindly map request bodies to database rows — including is_admin and role. Here's why it happens and how to stop it.Wed, 22 Jul 2026 00:00:00 GMTsecurityai-code-reviewengineeringCopper Sun Brass Teamhttps://coppersun.dev/blog/onboarding-ai-assisted-developers/https://coppersun.dev/blog/onboarding-ai-assisted-developers/A 3-step playbook for adding BrassCoders to any dev environment: install the CLI, add a pre-commit hook, add a CI gate. Security baseline from day one.Wed, 22 Jul 2026 00:00:00 GMTengineeringoss-coreai-code-reviewCopper Sun Brass Teamhttps://coppersun.dev/blog/owasp-llm-top-10-for-builders/https://coppersun.dev/blog/owasp-llm-top-10-for-builders/The OWASP LLM Top 10 (2025) maps where AI applications break. This post maps which categories static analysis can reach — and which ones it can't, and why.Wed, 22 Jul 2026 00:00:00 GMTsecurityai-code-reviewengineeringCopper Sun Brass Teamhttps://coppersun.dev/blog/path-traversal-ai-generated-python/https://coppersun.dev/blog/path-traversal-ai-generated-python/os.path.join(upload_dir, user_filename) is syntactically correct and semantically dangerous. Here's why AI assistants generate this pattern and what catches it.Wed, 22 Jul 2026 00:00:00 GMTsecurityai-code-reviewbenchmarksCopper Sun Brass Teamhttps://coppersun.dev/blog/scanning-ai-typescript-security/https://coppersun.dev/blog/scanning-ai-typescript-security/AI assistants generate TypeScript with predictable security patterns — hardcoded keys, eval() calls, and unvalidated request data. Here's exactly what BrassCoders catches and where coverage ends.Wed, 22 Jul 2026 00:00:00 GMTsecurityai-code-reviewengineeringCopper Sun Brass Teamhttps://coppersun.dev/blog/soc2-audit-trail-ai-development/https://coppersun.dev/blog/soc2-audit-trail-ai-development/SOC2 CC7.1 requires evidence that code was scanned before deployment. When AI writes the code, that evidence must show the AI-generated output went through the same scan gate — not just human-written commits.Wed, 22 Jul 2026 00:00:00 GMTsecuritycomplianceengineeringCopper Sun Brass Teamhttps://coppersun.dev/blog/sqlalchemy-raw-query-ai-generated/https://coppersun.dev/blog/sqlalchemy-raw-query-ai-generated/SQLAlchemy's ORM parameterizes by default. But when AI assistants hit complex queries, they reach for text() with f-strings — and Bandit B608 fires on that pattern every time.Wed, 22 Jul 2026 00:00:00 GMTsecurityai-code-reviewbenchmarksCopper Sun Brass Teamhttps://coppersun.dev/blog/ssl-verify-false-ai-generated-python/https://coppersun.dev/blog/ssl-verify-false-ai-generated-python/AI assistants add requests verify=False to silence SSL certificate errors. BrassCoders flags it as HIGH severity. Here's the attack path and the actual fix.Wed, 22 Jul 2026 00:00:00 GMTsecurityai-code-reviewCopper Sun Brass Teamhttps://coppersun.dev/blog/ssrf-ai-tool-calls/https://coppersun.dev/blog/ssrf-ai-tool-calls/When an LLM returns a URL and the application fetches it without checking, the attacker controls the destination. Here's what that looks like in agentic code, what BrassCoders can catch, and what the AI triage layer handles.Wed, 22 Jul 2026 00:00:00 GMTsecurityai-code-reviewengineeringCopper Sun Brass Teamhttps://coppersun.dev/blog/vibe-coding-secrets-policy/https://coppersun.dev/blog/vibe-coding-secrets-policy/AI coding assistants complete credential fields with whatever looks plausible. They have no access to your secrets manager, Vault config, or environment-variable conventions — and vibe coding removes the review step that would have caught it.Wed, 22 Jul 2026 00:00:00 GMTsecurityai-code-reviewoss-coreCopper Sun Brass Teamhttps://coppersun.dev/blog/vibe-coding-team-consistency/https://coppersun.dev/blog/vibe-coding-team-consistency/Ten developers using AI assistants produce ten different vulnerability surfaces. One deterministic scanner with fixed rules is the team-level gate that fixes this.Wed, 22 Jul 2026 00:00:00 GMTsecurityai-code-reviewengineeringCopper Sun Brass Teamhttps://coppersun.dev/blog/vibe-coding-velocity-risk/https://coppersun.dev/blog/vibe-coding-velocity-risk/Andrej Karpathy coined vibe coding in February 2025. BrassCoders scanned 15 AI-generated Python files and found real issues in 9 — with zero generation-time warnings. That gap is the velocity risk.Wed, 22 Jul 2026 00:00:00 GMTsecurityai-code-reviewengineeringCopper Sun Brass Teamhttps://coppersun.dev/blog/weak-random-ai-generated-python/https://coppersun.dev/blog/weak-random-ai-generated-python/Python's random module is predictable to attackers. BrassCoders flags it via Bandit B311 — the fix is one import swap to secrets.Wed, 22 Jul 2026 00:00:00 GMTsecurityai-code-reviewbenchmarksCopper Sun Brass Teamhttps://coppersun.dev/blog/xss-llm-output-ai-applications/https://coppersun.dev/blog/xss-llm-output-ai-applications/User-influenced prompt input reaches your HTML page unescaped. The fix is Jinja2 autoescape=True. BrassCoders flags the misconfiguration before the model ever runs.Wed, 22 Jul 2026 00:00:00 GMTsecurityai-code-reviewengineeringCopper Sun Brass Teamhttps://coppersun.dev/blog/package-hallucination-the-import-your-ai-invented/https://coppersun.dev/blog/package-hallucination-the-import-your-ai-invented/AI coding assistants generate package names that don't exist on PyPI. BrassCoders catches them before they become a supply chain attack.Fri, 17 Jul 2026 00:00:00 GMTsecurityai-code-reviewCopper Sun Brass Teamhttps://coppersun.dev/blog/brass-seo-boundary-content-case-study/https://coppersun.dev/blog/brass-seo-boundary-content-case-study/Brass-SEO published a case study on the boundary-content GEO strategy behind this blog: winning AI citations by answering the questions BrassCoders doesn't own.Tue, 14 Jul 2026 00:00:00 GMTengineeringCopper Sun Brass Teamhttps://coppersun.dev/blog/every-ai-code-review-blind-spot-is-the-same/https://coppersun.dev/blog/every-ai-code-review-blind-spot-is-the-same/Everything a code scanner misses in AI-generated code reduces to one root cause: it sees structure, never intent, and never the running system.Tue, 14 Jul 2026 00:00:00 GMTai-code-reviewsecurityengineeringCopper Sun Brass Teamhttps://coppersun.dev/blog/logic-bug-no-scanner-can-see/https://coppersun.dev/blog/logic-bug-no-scanner-can-see/A scanner proves code matches a known-bad shape; it can't prove the code does the right thing. A logic bug leaves no pattern to match — which is why BrassCoders hands correctness to the LLM layer, with benchmark data to show the seam.Tue, 14 Jul 2026 00:00:00 GMTai-code-reviewbenchmarksengineeringCopper Sun Brass Teamhttps://coppersun.dev/blog/prompt-injection-ai-coding-agents/https://coppersun.dev/blog/prompt-injection-ai-coding-agents/Prompt injection is a runtime attack on the AI agent reading your repository, not a pattern in the code it writes. No source scanner sees it. Here's where the exposure is and where the mitigations actually live.Tue, 14 Jul 2026 00:00:00 GMTsecurityai-code-reviewengineeringCopper Sun Brass Teamhttps://coppersun.dev/blog/security-misconfiguration-is-a-runtime-fact/https://coppersun.dev/blog/security-misconfiguration-is-a-runtime-fact/Debug mode on in production, a missing security header, a permissive CORS policy — these are properties of the deployed system, not literals a source scan reads. BrassCoders catches the ones hardcoded in source and names the rest as the runtime layer's job.Tue, 14 Jul 2026 00:00:00 GMTsecurityai-code-reviewengineeringCopper Sun Brass Teamhttps://coppersun.dev/blog/the-authorization-bug-no-scanner-understands/https://coppersun.dev/blog/the-authorization-bug-no-scanner-understands/Authorization is a fact about who should access what — intent a pattern scanner can't see. That's why broken access control is OWASP's #1 web risk, and why an AI-written authz check that looks plausible is the dangerous case. BrassCoders draws the line.Tue, 14 Jul 2026 00:00:00 GMTsecurityai-code-reviewCopper Sun Brass Teamhttps://coppersun.dev/blog/the-backdoor-built-to-pass-review/https://coppersun.dev/blog/the-backdoor-built-to-pass-review/A pattern scanner flags known-bad shapes. A deliberate backdoor is engineered to look like known-good code — which is how the xz-utils backdoor cleared human review and every static check. That's the provenance layer, not the scan.Tue, 14 Jul 2026 00:00:00 GMTsecurityai-code-reviewbenchmarksCopper Sun Brass Teamhttps://coppersun.dev/blog/the-slow-code-no-scanner-can-flag/https://coppersun.dev/blog/the-slow-code-no-scanner-can-flag/A scanner flags performance anti-patterns — a nested loop, an N+1 query shape. It can't tell you your actual bottleneck, because the hotspot is a measured property of a running workload. That's a profiler's job, and BrassCoders says so.Tue, 14 Jul 2026 00:00:00 GMTengineeringai-code-reviewbenchmarksCopper Sun Brass Teamhttps://coppersun.dev/blog/weak-crypto-ai-generated-python/https://coppersun.dev/blog/weak-crypto-ai-generated-python/AI assistants reach for MD5, AES-ECB, and the random module because their training data did. BrassCoders flags every instance through Bandit's crypto rules, and the research measures how often it matters.Tue, 14 Jul 2026 00:00:00 GMTsecurityai-code-reviewbenchmarksCopper Sun Brass Teamhttps://coppersun.dev/blog/what-ai-recommends-to-catch-ai-bugs/https://coppersun.dev/blog/what-ai-recommends-to-catch-ai-bugs/Ask any AI assistant how to catch the bugs your AI writes and the answers split in two: deterministic scanners for structural bugs, an LLM for intent.Tue, 14 Jul 2026 00:00:00 GMTai-code-reviewengineeringbenchmarksCopper Sun Brass Teamhttps://coppersun.dev/blog/where-llm-apps-leak-data/https://coppersun.dev/blog/where-llm-apps-leak-data/A source scanner catches PII written into code. An LLM app leaks at inference, when the model emits data it was handed — a string that never appears in your source. That's a different layer, and BrassCoders says so.Tue, 14 Jul 2026 00:00:00 GMTsecurityai-code-reviewprivacyCopper Sun Brass Teamhttps://coppersun.dev/blog/ai-assistant-needs-deterministic-pre-pass/https://coppersun.dev/blog/ai-assistant-needs-deterministic-pre-pass/A deterministic scanner narrows scope before your AI assistant triages. Research backs the hybrid: the pre-pass finds what rules catch; the model handles what rules can't.Wed, 08 Jul 2026 00:00:00 GMTai-code-reviewoss-coreengineeringCopper Sun Brass Teamhttps://coppersun.dev/blog/command-injection-ai-python-shell-true/https://coppersun.dev/blog/command-injection-ai-python-shell-true/BrassCoders found command injection in 2 of 15 AI-generated files: run_command.py used subprocess with shell=True on a string argument, thumbnail.py used os.system with an f-string path.Wed, 08 Jul 2026 00:00:00 GMTsecurityai-code-reviewbenchmarksCopper Sun Brass Teamhttps://coppersun.dev/blog/false-positive-feature-not-bug-static-analysis/https://coppersun.dev/blog/false-positive-feature-not-bug-static-analysis/BrassCoders flagged 53 findings across 15 AI-generated files. On triage, 9 of 15 were real. The gap between those numbers is the reason a scanner that infers intent would be worse.Wed, 08 Jul 2026 00:00:00 GMTai-code-reviewoss-coreengineeringCopper Sun Brass Teamhttps://coppersun.dev/blog/findings-file-vs-chat-prompt-ai-code-review/https://coppersun.dev/blog/findings-file-vs-chat-prompt-ai-code-review/BrassCoders writes .brass/ai_instructions.yaml with severity, file path, line number, and remediation for every finding. A chat prompt gives none of that. Here's why the difference matters.Wed, 08 Jul 2026 00:00:00 GMTai-code-reviewoss-coreengineeringCopper Sun Brass Teamhttps://coppersun.dev/blog/hardcoded-credentials-ai-generated-python/https://coppersun.dev/blog/hardcoded-credentials-ai-generated-python/BrassCoders found hardcoded credentials in 2 of 15 AI-generated files: token_check.py had a literal HMAC signing key, email_sender.py had an SMTP password. Both came from realistic prompts.Wed, 08 Jul 2026 00:00:00 GMTsecurityai-code-reviewbenchmarksCopper Sun Brass Teamhttps://coppersun.dev/blog/how-claude-code-reads-brasscoders-findings/https://coppersun.dev/blog/how-claude-code-reads-brasscoders-findings/BrassCoders writes .brass/ai_instructions.yaml sorted by severity, with line numbers and remediation notes. Here's what Claude Code does with each field and why the structure matters.Wed, 08 Jul 2026 00:00:00 GMTai-code-reviewoss-coreengineeringCopper Sun Brass Teamhttps://coppersun.dev/blog/llm-reviewer-not-a-security-gate/https://coppersun.dev/blog/llm-reviewer-not-a-security-gate/BrassCoders' benchmark found the model issued zero proactive security warnings during code generation, then caught 12 of 12 bugs when asked to review. A gate needs to run without being asked.Wed, 08 Jul 2026 00:00:00 GMTsecurityai-code-reviewoss-coreCopper Sun Brass Teamhttps://coppersun.dev/blog/sql-injection-ai-generated-python/https://coppersun.dev/blog/sql-injection-ai-generated-python/BrassCoders found SQL injection in 2 of 15 AI-generated Python files. Both used Python string formatting to build queries. Both passed prompt review. Neither Pylint nor the model warned during generation.Wed, 08 Jul 2026 00:00:00 GMTsecurityai-code-reviewbenchmarksCopper Sun Brass Teamhttps://coppersun.dev/blog/unsafe-deserialization-ai-python-yaml-pickle-eval/https://coppersun.dev/blog/unsafe-deserialization-ai-python-yaml-pickle-eval/AI assistants reach for the simpler API. yaml.load executes arbitrary Python on unsafe input. BrassCoders found it in config_loader.py, an AI-generated file from a realistic prompt.Wed, 08 Jul 2026 00:00:00 GMTsecurityai-code-reviewbenchmarksCopper Sun Brass Teamhttps://coppersun.dev/blog/yaml-first-context-pattern-ai-coding-assistants/https://coppersun.dev/blog/yaml-first-context-pattern-ai-coding-assistants/BrassCoders writes .brass/ai_instructions.yaml — plain YAML, no proprietary encoding. Here's how to use that file as context in Claude Code, Cursor, and Continue.Wed, 08 Jul 2026 00:00:00 GMTai-code-reviewoss-coreengineeringCopper Sun Brass Teamhttps://coppersun.dev/blog/ai-code-buggier-2026-data/https://coppersun.dev/blog/ai-code-buggier-2026-data/Sourced: Veracode found 45% of AI code carries an OWASP Top 10 flaw, CodeRabbit measured 1.7x more issues per PR, and ~20% of AI-suggested packages don't exist.Mon, 29 Jun 2026 00:00:00 GMTbenchmarksai-code-reviewsecurityCopper Sun Brass Teamhttps://coppersun.dev/blog/ai-coding-speed-perception-gap/https://coppersun.dev/blog/ai-coding-speed-perception-gap/METR's 2025 trial found experienced developers were 19% slower with AI tools while believing they were 20% faster. The gap is unreviewed code.Mon, 29 Jun 2026 00:00:00 GMTai-code-reviewengineeringCopper Sun Brass Teamhttps://coppersun.dev/blog/ai-python-bug-taxonomy/https://coppersun.dev/blog/ai-python-bug-taxonomy/Research sorts bugs in AI-generated code into eight classes. Here's which a deterministic Python scanner catches and which still need a human or an LLM.Mon, 29 Jun 2026 00:00:00 GMTai-code-reviewengineeringoss-coreCopper Sun Brass Teamhttps://coppersun.dev/blog/ai-python-static-analysis-benchmark/https://coppersun.dev/blog/ai-python-static-analysis-benchmark/BrassCoders flagged a finding in all 15 AI-generated Python files. On triage, 9 carried a real security or performance issue. The other findings were the reason you triage.Mon, 29 Jun 2026 00:00:00 GMTbenchmarksai-code-reviewoss-coreCopper Sun Brass Teamhttps://coppersun.dev/blog/deterministic-gate-vs-llm-reviewer/https://coppersun.dev/blog/deterministic-gate-vs-llm-reviewer/LLM reviewers vary run to run and mislocate findings. A deterministic scanner returns the same findings every commit. A 2025 benchmark backs running both.Mon, 29 Jun 2026 00:00:00 GMTai-code-reviewengineeringoss-coreCopper Sun Brass Teamhttps://coppersun.dev/blog/catching-hallucinated-imports/https://coppersun.dev/blog/catching-hallucinated-imports/AI assistants invent package names that don't exist; one study found 19.7%. BrassCoders flags every unresolvable import before the install runs.Tue, 23 Jun 2026 00:00:00 GMTsecurityoss-coreCopper Sun Brass Teamhttps://coppersun.dev/blog/catching-slow-ai-generated-code/https://coppersun.dev/blog/catching-slow-ai-generated-code/AI assistants write O(N²) loops that pass every test and crawl at scale. BrassCoders flags all four patterns where Bandit and Semgrep catch none.Tue, 23 Jun 2026 00:00:00 GMTbenchmarksoss-coreCopper Sun Brass Teamhttps://coppersun.dev/blog/catching-hardcoded-secrets/https://coppersun.dev/blog/catching-hardcoded-secrets/AI assistants hardcode realistic-looking API keys into example code. BrassCoders bundles detect-secrets and adds custom formats, covering 20+ credential types.Tue, 23 Jun 2026 00:00:00 GMTsecurityoss-coreCopper Sun Brass Teamhttps://coppersun.dev/blog/flagging-pii-in-ai-code/https://coppersun.dev/blog/flagging-pii-in-ai-code/AI assistants drop real-looking names, emails, and SSNs into fixtures and stubs. BrassCoders flags PII-shaped strings in source before they reach a shared repo.Tue, 23 Jun 2026 00:00:00 GMTprivacyoss-coreCopper Sun Brass Teamhttps://coppersun.dev/blog/oss-core-vs-paid/https://coppersun.dev/blog/oss-core-vs-paid/All 12 scanners are free in the OSS core; Paid adds ranking, not detection. The honest line on when free is enough and when $12/dev/month pays off.Tue, 23 Jun 2026 00:00:00 GMTcomparisonoss-coreCopper Sun Brass Teamhttps://coppersun.dev/blog/oss-scanners-brasscoders-bundles/https://coppersun.dev/blog/oss-scanners-brasscoders-bundles/BrassCoders bundles Bandit, Pylint, Pyre/Pysa, Semgrep, ast-grep, and detect-secrets into one scan: one install, one ranked YAML, no six-tool config.Tue, 23 Jun 2026 00:00:00 GMToss-coreengineeringCopper Sun Brass Teamhttps://coppersun.dev/blog/scanning-ai-javascript-typescript/https://coppersun.dev/blog/scanning-ai-javascript-typescript/BrassCoders runs a Babel-based JavaScript and TypeScript scanner on .js and .ts files automatically, catching secrets and security patterns alongside Python.Tue, 23 Jun 2026 00:00:00 GMTsecurityoss-coreCopper Sun Brass Teamhttps://coppersun.dev/blog/what-paid-enrichment-does/https://coppersun.dev/blog/what-paid-enrichment-does/The OSS core finds everything; the Paid plan ranks it. BrassCoders Paid cuts a typical 1500+ raw findings to a focused 50-80, for $12 per developer per month.Tue, 23 Jun 2026 00:00:00 GMTpaid-planai-code-reviewCopper Sun Brass Teamhttps://coppersun.dev/blog/why-better-ai-models-make-bugs-harder-to-catch/https://coppersun.dev/blog/why-better-ai-models-make-bugs-harder-to-catch/As AI coding assistants get better, the obvious bugs vanish and the structural ones hide inside code that looks too clean to question.Mon, 22 Jun 2026 00:00:00 GMTai-code-reviewsecurityCopper Sun Brass Teamhttps://coppersun.dev/blog/add-brasscoders-to-gitlab-ci/https://coppersun.dev/blog/add-brasscoders-to-gitlab-ci/Add BrassCoders to your GitLab CI pipeline in under 10 minutes. Full .gitlab-ci.yml config, artifact upload, merge request gates, and Paid plan license key setup.Sat, 20 Jun 2026 00:00:00 GMTgitlabci-cdsecurityCopper Sun Brass Teamhttps://coppersun.dev/blog/ai-generated-test-debt/https://coppersun.dev/blog/ai-generated-test-debt/AI coding assistants write tests that pass CI but miss real bugs: always-true assertions, empty bodies, mock-everything tests. What BrassCoders catches and what requires mutation testing.Sat, 20 Jun 2026 00:00:00 GMTtestingtest-qualityai-code-reviewCopper Sun Brass Teamhttps://coppersun.dev/blog/brasscoders-cursor-workflow/https://coppersun.dev/blog/brasscoders-cursor-workflow/Run brasscoders scan, open .brass/ai_instructions.yaml in Cursor, ask Cursor to triage. The workflow for reviewing AI-generated code without reading 1500 raw findings yourself.Sat, 20 Jun 2026 00:00:00 GMTcursorworkflowai-code-reviewCopper Sun Brass Teamhttps://coppersun.dev/blog/brasscoders-research-now-public/https://coppersun.dev/blog/brasscoders-research-now-public/The 45-source evidence base behind BrassCoders is now on GitHub: 8 research categories on AI-code risk, machine-readable JSON, and an llms.txt built for AI assistants.Sat, 20 Jun 2026 00:00:00 GMTlaunchoss-coreCopper Sun Brass Teamhttps://coppersun.dev/blog/django-security-ai-coders/https://coppersun.dev/blog/django-security-ai-coders/Four Django security patterns AI coding assistants get wrong: SQL injection via raw(), missing CSRF_COOKIE_SECURE, DEBUG=True in production, and unsafe mark_safe(). Code examples and BrassCoders findings.Sat, 20 Jun 2026 00:00:00 GMTdjangosecurityai-code-reviewCopper Sun Brass Teamhttps://coppersun.dev/blog/python-dependency-hallucination/https://coppersun.dev/blog/python-dependency-hallucination/USENIX Security 2025: 19.7% of AI-recommended packages don't exist. Lasso Security's PoC received 30,000+ downloads. How the PyPI attack surface works, and how BrassCoders's phantom-package scanner catches it before pip install runs.Sat, 20 Jun 2026 00:00:00 GMTsecuritydependencieshallucinationsupply-chainCopper Sun Brass Teamhttps://coppersun.dev/blog/snyk-vs-brasscoders/https://coppersun.dev/blog/snyk-vs-brasscoders/Snyk catches CVEs in your dependencies. BrassCoders catches bugs in your source code. Different attack surfaces, different tools — here's when you need each.Sat, 20 Jun 2026 00:00:00 GMTcomparisonsnyksecurityCopper Sun Brass Teamhttps://coppersun.dev/blog/soc2-audit-trail-brasscoders/https://coppersun.dev/blog/soc2-audit-trail-brasscoders/SOC 2 Type II requires evidence of continuous vulnerability monitoring. The .brass/detailed_analysis.yaml file — retained 90 days in CI artifacts — provides machine-readable evidence of what was scanned, when, and what was found.Sat, 20 Jun 2026 00:00:00 GMTsoc2compliancesecurityCopper Sun Brass Teamhttps://coppersun.dev/blog/sonarqube-vs-brasscoders/https://coppersun.dev/blog/sonarqube-vs-brasscoders/SonarQube is a code-quality workflow platform. BrassCoders is a focused AI-coder CI gate with YAML output for AI assistants. They solve different problems — here's when you need each, and when you need both.Sat, 20 Jun 2026 00:00:00 GMTcomparisonsonarqubeci-cdCopper Sun Brass Teamhttps://coppersun.dev/blog/triage-static-analysis-findings/https://coppersun.dev/blog/triage-static-analysis-findings/How to work through BrassCoders findings without burning out your team: severity tiers, when to fix vs suppress, .brassignore vs inline comments, and how AI enrichment changes the calculus.Sat, 20 Jun 2026 00:00:00 GMTworkflowtriagestatic-analysisCopper Sun Brass Teamhttps://coppersun.dev/blog/tuning-brasscoders-brassignore/https://coppersun.dev/blog/tuning-brasscoders-brassignore/A fresh brasscoders scan on a medium Django project produces 1500+ findings. .brassignore cuts that to ~300 signal findings without touching the Paid plan. Here's every pattern worth adding.Sat, 20 Jun 2026 00:00:00 GMTconfigurationnoise-reductionbrassignoreCopper Sun Brass Teamhttps://coppersun.dev/blog/add-brasscoders-to-github-actions/https://coppersun.dev/blog/add-brasscoders-to-github-actions/Step-by-step guide to adding BrassCoders static analysis to your Python CI pipeline with GitHub Actions — copy-paste workflow, artifact upload, and build-failure configuration.Fri, 19 Jun 2026 00:00:00 GMToss-coreai-code-reviewsecurityCopper Sun Brass Teamhttps://coppersun.dev/blog/ai-team-code-review-policy/https://coppersun.dev/blog/ai-team-code-review-policy/A practical template for writing a code review policy when 40% of your diff is AI-generated. Covers pre-commit gates, CI enforcement, human review thresholds, and audit trails.Fri, 19 Jun 2026 00:00:00 GMTai-code-reviewsecurityoss-coreCopper Sun Brass Teamhttps://coppersun.dev/blog/brasscoders-vs-coderabbit/https://coppersun.dev/blog/brasscoders-vs-coderabbit/BrassCoders and CodeRabbit occupy different pipeline slots — one scans every commit deterministically before a PR exists, the other reviews the diff conversationally when the PR opens. Most teams run both.Fri, 19 Jun 2026 00:00:00 GMTcomparisonai-code-reviewoss-coreCopper Sun Brass Teamhttps://coppersun.dev/blog/fastapi-security-ai-coders/https://coppersun.dev/blog/fastapi-security-ai-coders/What AI coding assistants get wrong with FastAPI — and how BrassCoders catches SQL injection, shell injection, and hardcoded credentials before they reach production.Fri, 19 Jun 2026 00:00:00 GMTsecurityai-code-reviewoss-coreCopper Sun Brass Teamhttps://coppersun.dev/blog/hipaa-soc2-code-scanning/https://coppersun.dev/blog/hipaa-soc2-code-scanning/Cloud API code reviewers transmit your source code to third-party endpoints on every commit. For HIPAA and SOC 2 teams, that transmission creates a compliance gap BrassCoders's local scanner avoids entirely.Fri, 19 Jun 2026 00:00:00 GMTsecurityprivacyoss-coreCopper Sun Brass Teamhttps://coppersun.dev/blog/pre-commit-hook-ai-coder-bugs/https://coppersun.dev/blog/pre-commit-hook-ai-coder-bugs/Set up BrassCoders as a pre-commit hook to block hardcoded secrets, SQL injection, and hallucinated imports before they hit your git history — 5 lines of config.Fri, 19 Jun 2026 00:00:00 GMToss-coresecurityai-code-reviewCopper Sun Brass Teamhttps://coppersun.dev/blog/semgrep-vs-brasscoders/https://coppersun.dev/blog/semgrep-vs-brasscoders/Semgrep and BrassCoders share a scanner. The useful question is what each adds that the other doesn't — for Python teams shipping AI-generated code.Fri, 19 Jun 2026 00:00:00 GMTcomparisonsecuritybenchmarksCopper Sun Brass Teamhttps://coppersun.dev/blog/vibe-coding-safety-net/https://coppersun.dev/blog/vibe-coding-safety-net/Vibe coding ships fast. The O(N²) loop, the hardcoded secret, the hallucinated import — they ship too. BrassCoders catches all four bug classes in 30 seconds.Fri, 19 Jun 2026 00:00:00 GMToss-coreai-code-reviewsecurityCopper Sun Brass Teamhttps://coppersun.dev/blog/ai-coding-market-2026-five-numbers/https://coppersun.dev/blog/ai-coding-market-2026-five-numbers/Gartner projects 75-90% of enterprise engineers on AI assistants by 2028. Copilot has 4.7M paid seats, Cursor $2B ARR, Claude Code a multi-billion run-rate. Five numbers.Mon, 15 Jun 2026 00:00:00 GMTengineeringai-code-reviewCopper Sun Brass Teamhttps://coppersun.dev/blog/ai-code-review-is-not-a-control/https://coppersun.dev/blog/ai-code-review-is-not-a-control/Asking an AI to review your AI's code is not a quality control. It's a conversation. Here's why the distinction matters for anyone shipping AI-assisted software.Sat, 13 Jun 2026 00:00:00 GMTai-code-reviewengineeringCopper Sun Brass Teamhttps://coppersun.dev/blog/ai-coder-bug-benchmark/https://coppersun.dev/blog/ai-coder-bug-benchmark/Head-to-head on 12 AI-generated Python files: BrassCoders 11/12, Claude 12/12, Bandit 6/12, Pylint 1/12. What the numbers mean for your pre-merge workflow.Sat, 13 Jun 2026 00:00:00 GMTbenchmarksai-code-reviewoss-coreCopper Sun Brass Teamhttps://coppersun.dev/blog/ai-coder-perf-bugs-in-the-wild/https://coppersun.dev/blog/ai-coder-perf-bugs-in-the-wild/A walkthrough of the four AI-coder performance anti-patterns BrassCoders catches that Bandit, Pylint, and a frontier model reviewer all miss: O(N²) string concat, insert-at-zero loops, triple-nested joins, and unbounded polls.Sat, 13 Jun 2026 00:00:00 GMTbenchmarksengineeringoss-coreCopper Sun Brass Teamhttps://coppersun.dev/blog/what-api-review-sends-off-your-machine/https://coppersun.dev/blog/what-api-review-sends-off-your-machine/When you invoke an AI code reviewer, your source code travels to an external API. Here's exactly what gets sent, why that matters for regulated and proprietary codebases, and what the alternative looks like.Sat, 13 Jun 2026 00:00:00 GMTprivacyai-code-reviewengineeringCopper Sun Brass Teamhttps://coppersun.dev/blog/why-bandit-misses-ai-coder-bugs/https://coppersun.dev/blog/why-bandit-misses-ai-coder-bugs/Bandit caught 6 of 12 planted bugs in BrassCoders's AI-coder benchmark — and 0 of the 4 performance anti-patterns AI coding assistants introduce most often. Here's why, and what to add alongside it.Sat, 13 Jun 2026 00:00:00 GMTbenchmarkscomparisonoss-coreCopper Sun Brass Teamhttps://coppersun.dev/blog/the-other-tools-copper-sun-builds/https://coppersun.dev/blog/the-other-tools-copper-sun-builds/BrassCoders is one of five AI tools from Copper Sun Content and Creative. Here are the other four, and why an engineer might actually want them.Tue, 09 Jun 2026 00:00:00 GMTcopper-sunprivacyCopper Sun Brass Teamhttps://coppersun.dev/blog/audit-ready-ai-code-scan/https://coppersun.dev/blog/audit-ready-ai-code-scan/Auditors do not accept stochastic scanner output. Deterministic, reproducible, citation-ready YAML — the audit posture an AI-augmented engineering team needs by 2026.Sat, 06 Jun 2026 00:00:00 GMTsecurityengineeringCopper Sun Brass Teamhttps://coppersun.dev/blog/sast-finding-overload/https://coppersun.dev/blog/sast-finding-overload/A static-analysis report with 1,500 findings is functionally a report with zero findings — nobody reads it. The bottleneck is ranking, not detection.Fri, 05 Jun 2026 00:00:00 GMTsecurityengineeringCopper Sun Brass Teamhttps://coppersun.dev/blog/copilot-vs-brasscoders-division-of-labor/https://coppersun.dev/blog/copilot-vs-brasscoders-division-of-labor/AI code review and deterministic static analysis are complementary layers, not competitors. The math of running both, the hand-off prompt, and when replacing one with the other is wrong.Thu, 04 Jun 2026 00:00:00 GMTcomparisonai-code-reviewCopper Sun Brass Teamhttps://coppersun.dev/blog/cross-file-bugs-ai-misses/https://coppersun.dev/blog/cross-file-bugs-ai-misses/AI coding assistants reason within a single file's context window and miss bugs whose taint flows across three or more files. The category that ships past AI-assisted review.Wed, 03 Jun 2026 00:00:00 GMTsecurityengineeringCopper Sun Brass Teamhttps://coppersun.dev/blog/ai-code-cve-reckoning-q1-2026/https://coppersun.dev/blog/ai-code-cve-reckoning-q1-2026/AI-generated code drove a near-sixfold CVE increase within Q1 2026 — from 6 AI-attributed CVEs in January to 35 in March alone. A reading of what the data says about where deterministic detection needs to go.Tue, 02 Jun 2026 00:00:00 GMTsecurityai-code-reviewCopper Sun Brass Teamhttps://coppersun.dev/blog/brasscoders-open-source-on-github/https://coppersun.dev/blog/brasscoders-open-source-on-github/The full BrassCoders CLI is open source on GitHub under Apache 2.0. 12 scanners, source-auditable detection, contributions welcome. Repo at CopperSunDev/brasscoders.Tue, 02 Jun 2026 00:00:00 GMTlaunchoss-coreengineeringCopper Sun Brass Teamhttps://coppersun.dev/blog/brass-paid-launched/https://coppersun.dev/blog/brass-paid-launched/BrassCoders Paid is now generally available. $12/dev/month adds AI-powered semantic dedup, cluster sizing, and rank-by-relevance against your project signature. The OSS core stays free forever.Sun, 31 May 2026 00:00:00 GMTlaunchpaid-tierai-code-reviewCopper Sun Brass Teamhttps://coppersun.dev/blog/secrets-your-ai-might-leak/https://coppersun.dev/blog/secrets-your-ai-might-leak/AI coding assistants embed credentials in generated config files, example scripts, and test fixtures more often than developers expect. The detection pattern is entropy plus format matching — here is what BrassCoders scans for and why.Sun, 31 May 2026 00:00:00 GMTsecurityai-code-reviewprivacyCopper Sun Brass Teamhttps://coppersun.dev/blog/triage-500-line-ai-pr/https://coppersun.dev/blog/triage-500-line-ai-pr/A worked example of BrassCoders plus an AI assistant doing real PR review work. Scan locally, hand the ranked output to Claude Code or Cursor, walk each finding to a diff. Total reviewer time stays roughly constant regardless of diff size.Sun, 31 May 2026 00:00:00 GMTai-code-reviewengineeringoss-coreCopper Sun Brass Teamhttps://coppersun.dev/blog/what-brass-sends-to-its-servers/https://coppersun.dev/blog/what-brass-sends-to-its-servers/BrassCoders scans run entirely on your machine by default. The Paid plan adds one network call to our gateway with already-redacted findings, never raw source code. Here is every byte that leaves your machine.Sun, 31 May 2026 00:00:00 GMTprivacyoss-coreengineeringCopper Sun Brass Teamhttps://coppersun.dev/blog/when-ai-invents-libraries/https://coppersun.dev/blog/when-ai-invents-libraries/AI coding assistants confidently generate imports of packages that don't exist on PyPI or npm. The pattern is documented, the supply-chain risk is real, and the detection is straightforward — here is how it works.Sun, 31 May 2026 00:00:00 GMTsecurityai-code-reviewengineeringCopper Sun Brass Teamhttps://coppersun.dev/blog/why-claude-code-emits-eight-findings/https://coppersun.dev/blog/why-claude-code-emits-eight-findings/AI code review tools surface a lot of speculative noise alongside the real bugs. Here's why that happens and how to filter the output down to the findings that merit a developer's attention.Sun, 31 May 2026 00:00:00 GMTclaude-codeai-code-reviewnoise-reductionstatic-analysisCopper Sun Brass Team