Copper Sun Brass Coders

Copper Sun Brass Coders

@coppersun.dev

28 followers 65 following172 posts

Copper Sun Brass Coders

BrassCoders writes .brass/ai_instructions.yaml sorted by severity with line numbers and fixes. Claude Code reads it as a work queue: severity sets order, line number anchors the location, remediation states the fix pattern. Structure beats open-ended review. Read more → https://brss.fyi/1c3z

brss.fyiHow Claude Code Reads a BrassCoders Findings FileBrassCoders writes .brass/ai_instructions.yaml sorted by severity, with line numbers and remediation notes. Here's what Claude Code does with each field and why the structure matters.

Copper Sun Brass Coders

AI models embed hardcoded credentials to make example code runnable. BrassCoders found HMAC keys and SMTP passwords in 2 of 15 generated files — both from realistic prompts. Move secrets to environment variables. Catch what your AI coder misses → https://brss.fyi/slom

brss.fyiHardcoded Credentials in AI-Generated PythonBrassCoders found hardcoded credentials in 2 of 15 AI-generated files: token_check.py had a literal HMAC signing key, email_sender.py had an SMTP password. Both came from realistic prompts.

Copper Sun Brass Coders

BrassCoders writes .brass/ai_instructions.yaml with severity, file path, line number, and remediation for every finding. A chat prompt gives none of that—no persistent state, no line anchors, no format the tool expects. That's the gap the findings file closes. Read more → https://brss.fyi/z7v4

brss.fyiWhat a Findings File Does That a Chat Prompt Can'tBrassCoders writes .brass/ai_instructions.yaml with severity, file path, line number, and remediation for every finding. A chat prompt gives none of that. Here's why the difference matters.

Copper Sun Brass Coders

BrassCoders flagged 53 findings across 15 AI-generated files. Triage confirmed 9 real issues. The gap isn't noise—it's the scanner working as designed. Structural rules can't infer context. The triage layer does. Read more → https://brss.fyi/hhqn

brss.fyiThe False Positive Is a Feature, Not a BugBrassCoders flagged 53 findings across 15 AI-generated files. On triage, 9 of 15 were real. The gap between those numbers is the reason a scanner that infers intent would be worse.

Copper Sun Brass Coders

BrassCoders found command injection in 2 of 15 AI-generated files: subprocess with shell=True on caller input, os.system with f-string paths. Both execute arbitrary commands on attacker input. https://brss.fyi/1alx

brss.fyi`shell=True` in AI Python: Command InjectionBrassCoders found command injection in 2 of 15 AI-generated files: run_command.py used subprocess with shell=True on a string argument, thumbnail.py used os.system with an f-string path.

Copper Sun Brass Coders

Static analysis finds what rules catch. AI finds what context infers. Research backs the hybrid: deterministic scanner first, model second. BrassCoders runs 12 scanners, writes findings to .brass/ai_instructions.yaml, and lets your editor's AI assistant start from confirmation https://brss.fyi/acqq

brss.fyiWhy Your AI Assistant Needs a Dumb Pre-PassA deterministic scanner narrows scope before your AI assistant triages. Research backs the hybrid: the pre-pass finds what rules catch; the model handles what rules can't.

Copper Sun Brass Coders

LLM reviewers vary run to run. BrassCoders returns identical findings every commit. A 2025 benchmark backs running both: deterministic scanners pinpoint exact lines; LLMs catch intent. Offline, free, Apache 2.0. Read more → https://brss.fyi/yzie

brss.fyiWhy AI Code Needs a Deterministic Gate, Not Just an LLMLLM reviewers vary run to run and mislocate findings. A deterministic scanner returns the same findings every commit. A 2025 benchmark backs running both.

Copper Sun Brass Coders

Research sorts AI-generated Python bugs into eight classes. Deterministic scanners catch the structural ones—hallucinated imports, performance anti-patterns, secrets, syntax errors. Intent-dependent bugs (logic errors, missing cases) need human or LLM review. https://brss.fyi/8uli

brss.fyiA Field Taxonomy of Bugs in AI-Generated PythonResearch sorts bugs in AI-generated code into eight classes. Here's which a deterministic Python scanner catches and which still need a human or an LLM.

Copper Sun Brass Coders

Developers felt 20% faster with AI tools. METR's 2025 trial measured them 19% slower. The gap is unreviewed code. BrassCoders runs 12 deterministic scanners on every commit so the safety check doesn't depend on feeling. Read more → https://brss.fyi/uqs0

brss.fyiYou Feel 20% Faster. A Study Says 19% Slower.METR's 2025 trial found experienced developers were 19% slower with AI tools while believing they were 20% faster. The gap is unreviewed code.

Copper Sun Brass Coders

A security scanner that phones home has a trust problem. BrassCoders telemetry (2.1.0) is off by default, asked once, and never includes code, paths, or secrets. Every event writes to a local log before it sends, so you can check. Read more → https://brss.fyi/13ar

brss.fyiHow BrassCoders Designed Opt-In Usage TelemetryA security scanner that phones home has a trust problem. How BrassCoders 2.1.0 made telemetry off by default, readable before it sends, and easy to refuse.

Copper Sun Brass Coders

Veracode: 45% of AI code ships an OWASP Top 10 flaw. CodeRabbit: 1.7x more issues per PR. USENIX: ~20% of AI-suggested packages don't exist. The data is clear. BrassCoders catches what AI coders miss before merge. Read more → https://brss.fyi/v2l5

brss.fyiIs AI-Generated Code Buggier? The 2025-26 DataSourced: Veracode found 45% of AI code carries an OWASP Top 10 flaw, CodeRabbit measured 1.7x more issues per PR, and ~20% of AI-suggested packages don't exist.

Copper Sun Brass Coders

Vibe coding ships fast. So do the O(N²) loop, hardcoded secret, and hallucinated import. BrassCoders catches all four bug classes in 30 seconds. pip install brasscoders → https://brss.fyi/kdj2

brss.fyiVibe Coding Without the Regrets: The Safety NetVibe coding ships fast. The O(N²) loop, the hardcoded secret, the hallucinated import — they ship too. BrassCoders catches all four bug classes in 30 seconds.

Copper Sun Brass Coders

All 12 scanners run free. Paid ranks findings, not detects them. Stay free if 300 deduplicated findings fit your workflow. Upgrade to $12/dev/month when volume becomes the bottleneck. Start here → https://brss.fyi/8iv3

brss.fyiBrassCoders OSS Core vs Paid: When to UpgradeAll 12 scanners are free in the OSS core; Paid adds ranking, not detection. The honest line on when free is enough and when $12/dev/month pays off.

Copper Sun Brass Coders

BrassCoders OSS finds all bugs; Paid ranks them. 12 scanners run free. A typical 1500+ raw findings becomes 300 after dedup, then 50-80 after ranking. $12/dev/month. Read more → https://brss.fyi/14vc

brss.fyiWhat BrassCoders Paid's Enrichment Actually DoesThe OSS core finds everything; the Paid plan ranks it. In one published case study, BrassCoders Paid took a scan from 2,470 raw findings to 217 after heuristic reduction to 22 after enrichment, for $12 per developer per month.

Copper Sun Brass Coders

AI writes as much JavaScript and TypeScript as Python. BrassCoders now scans .js/.ts/.jsx/.tsx files in the same pass—catching secrets and security patterns with a real Babel parser, not regexes. Mixed repos, one command. Read more → https://brss.fyi/1s8q

brss.fyiScanning AI-Generated JavaScript and TypeScriptBrassCoders runs a Babel-based JavaScript and TypeScript scanner on .js and .ts files automatically, catching secrets and security patterns alongside Python.

Copper Sun Brass Coders

AI assistants drop real names, emails, SSNs into test fixtures. Some synthetic, some memorized from training data. BrassCoders flags PII-shaped strings before they hit your repo. Redacted at scan time—safe to hand to Claude Code or Cursor. Read more → https://brss.fyi/twqq

brss.fyiHow BrassCoders Flags PII in AI-Generated CodeAI assistants drop real-looking names, emails, and SSNs into fixtures and stubs. BrassCoders flags PII-shaped strings in source before they reach a shared repo.

Copper Sun Brass Coders

1 in 5 AI-generated SQL snippets ships a SQL injection hole, per Veracode's 2025 test of 100+ models. A 2022 study put Copilot's rate at 37%. Bandit's B608 check catches string-built SQL before it merges, one of 12 scanners in brasscoders. Read more → https://brss.fyi/116u

brss.fyiSQL Injection in AI-Generated Code, by the NumbersVeracode found 1 in 5 AI-generated SQL snippets still vulnerable, and a 2022 study put Copilot's SQL injection rate at 37%. The numbers, and how to catch it.

Copper Sun Brass Coders

AI-generated tests can hit 80% coverage on toy benchmarks and under 2% on real code. Coverage counts execution, not verification. A test that asserts nothing raises coverage as much as one that checks everything. Catch what your AI coder misses → https://brss.fyi/1p0o

brss.fyiWill Your AI Write Tests That Catch Real Bugs?AI test generators hit 80% coverage on toy benchmarks and under 2% on real code. Coverage counts execution, not verification. The numbers, and the real check.

Copper Sun Brass Coders

BrassCoders bundles six open-source scanners — Bandit, Pylint, Pyre/Pysa, Semgrep, ast-grep, detect-secrets — and runs them in one pass. One install, one ranked YAML output, no config sprawl. https://brss.fyi/nlnj

brss.fyiThe Six OSS Scanners BrassCoders Runs in One PassBrassCoders bundles Bandit, Pylint, Pyre/Pysa, Semgrep, ast-grep, and detect-secrets into one scan: one install, one ranked YAML, no six-tool config.

Copper Sun Brass Coders

AI assistants hardcode realistic API keys into example code. BrassCoders bundles detect-secrets and adds custom patterns for 20+ credential types—OpenAI, Anthropic, SendGrid, and more. Redacted at scan time, never transmitted. pip install brasscoders → https://brss.fyi/10z3

brss.fyiHow BrassCoders Catches Hardcoded Secrets in AI CodeAI assistants hardcode realistic-looking API keys into example code. BrassCoders bundles detect-secrets and adds custom formats, covering 20+ credential types.

Copper Sun Brass Coders

BrassCoders now catches all 11 documented vulnerabilities in OWASP PyGoat, up from 7 in May. SQL injection, insecure deserialization, command injection, and eval() abuse all now flagged at the correct file and line. Pinned commit, reproducible scan. Read more → https://brss.fyi/16di

brss.fyiWhat BrassCoders Catches in OWASP PyGoatA real scan of OWASP's intentionally-vulnerable PyGoat app: BrassCoders now catches all 11 documented findings, including 4 gaps closed since the May baseline.

Copper Sun Brass Coders

AI assistants write O(N²) loops that pass tests and crawl at scale. BrassCoders flags four patterns—string concatenation, list.insert(0), nested-loop joins, unbounded reads—that Bandit and Semgrep miss. Deterministic, not profiled. Catches them before merge. Read more → https://brss.fyi/tpqt

brss.fyiHow BrassCoders Catches Slow AI-Generated CodeAI assistants write O(N²) loops that pass every test and crawl at scale. BrassCoders flags all four patterns where Bandit and Semgrep catch none.

Copper Sun Brass Coders

AI coders hallucinate imports. brasscoders scan --check-package-hallucination catches them before they ship. One flag flags packages that don't exist on PyPI—the only OSS check that calls the network. Typosquatters are waiting. Read more → https://brss.fyi/1d7u

brss.fyiWhen AI Invents Libraries: Detecting Hallucinated ImportsAI coding assistants confidently generate imports of packages that don't exist on PyPI or npm. The pattern is documented, the supply-chain risk is real, and the detection is straightforward — here is how it works.

Copper Sun Brass Coders

BrassCoders OSS core makes zero network calls. Paid plan sends one request: redacted findings + project signature. Never raw source code. Verify it yourself. Read more → https://brss.fyi/qaeg

brss.fyiWhat BrassCoders Sends to Its Servers (And What It Doesn't)BrassCoders scans run entirely on your machine by default. The Paid plan adds one network call to our gateway with already-redacted findings, never raw source code. Here is every byte that leaves your machine.

Copper Sun Brass Coders

Scan a 500-line AI PR in 10 min. Run brasscoders locally, pipe the ranked YAML to Claude Code or Cursor, walk each finding to a diff. Reviewer time stays flat whether the PR is 100 or 1000 lines. Read more → https://brss.fyi/1jqy

brss.fyiHow to Triage a 500-Line AI Pull Request in 10 MinutesA worked example of BrassCoders plus an AI assistant doing real PR review work. Scan locally, hand the ranked output to Claude Code or Cursor, walk each finding to a diff. Total reviewer time stays roughly constant regardless of diff size.

Copper Sun Brass Coders

AI assistants leak secrets in generated config files and test fixtures. BrassCoders detects 20+ canonical formats (AWS keys, GitHub tokens, OpenAI creds, PEM keys, etc.) plus high-entropy fallback. Catch what your AI coder misses → https://brss.fyi/80nq

brss.fyiThe Secrets Your AI Assistant Might Leak (And How to Catch Them)AI coding assistants embed credentials in generated config files, example scripts, and test fixtures more often than developers expect. The detection pattern is entropy plus format matching — here is what BrassCoders scans for and why.

Copper Sun Brass Coders

An AI wrote (a+)+$ in half a second. That shape hung Cloudflare's whole network for 27 minutes in 2019, and it's already landed CVEs in ajv and minimatch. Semgrep catches it before merge. Copper Sun Brass bundles it as one of 12 scanners. Read more → https://brss.fyi/1f4d

brss.fyiWill Your AI Write A Regex That Hangs Your Server?Catastrophic backtracking turns one crafted input into a denial-of-service attack: real npm advisories and how to catch it before it ships.

Copper Sun Brass Coders

PyYAML's yaml.load carried a 9.8 CVSS CVE. PyTorch's torch.load(weights_only=True), called safe in its own docs, carried a 9.3 CVE in 2025. BrassCoders flags pickle.load and unsafe yaml.load on every scan. Read more → https://brss.fyi/11ia

brss.fyiThe CVE Record on Insecure Deserialization in AI Python CodePyYAML's yaml.load carried a CVSS 9.8 CVE. PyTorch's torch.load carried one at 9.3, in 2025, in a flag documented as safe. Here is the actual track record.

Copper Sun Brass Coders

Your AI coding assistant can reproduce license-encumbered training data. GitHub's own data shows Copilot matches public code in under 1% of suggestions. A federal lawsuit over this exact question is still unresolved since 2022. Read more → https://brss.fyi/13at

brss.fyiAI Code License Risk From Training-Data MemorizationAI coding assistants can reproduce license-encumbered training data. Here is what the memorization research, GitHub's own data, and an active lawsuit say.

Copper Sun Brass Coders

OWASP finds broken access control in 94% of tested apps. Its API-specific twin, BOLA, drives 27% of real attack traffic per Salt Labs. No scanner can verify an ownership check without knowing your data model. Here's what BrassCoders can actually flag. Read more → https://brss.fyi/1m4d

brss.fyiIDOR and Access Control in AI APIs, by the NumbersOWASP ranks broken access control the top web risk and BOLA the top API risk. Real prevalence and attack data, and what BrassCoders can honestly flag.

Copper Sun Brass Coders

BrassCoders Paid launches today. $12/dev/month adds AI-powered semantic dedup and relevance ranking—turns 1500+ raw findings into ~300 actionable ones. The OSS core (12 deterministic scanners) stays free forever. Read more → https://brss.fyi/xhkq

brss.fyiBrassCoders Paid is live: $12/dev/month for AI-powered noise reductionBrassCoders Paid is now generally available. $12/dev/month adds AI-powered semantic dedup, cluster sizing, and rank-by-relevance against your project signature. The OSS core stays free forever.

Copper Sun Brass Coders

BrassCoders CLI is now open source on GitHub under Apache 2.0. Audit 12 deterministic scanners, fork the detection logic, or contribute improvements. Full repo: CopperSunDev/brasscoders. pip install brasscoders → https://brss.fyi/9m5g

brss.fyiBrassCoders Is Now Open Source on GitHubThe full BrassCoders CLI is open source on GitHub under Apache 2.0. 12 scanners, source-auditable detection, contributions welcome. Repo at CopperSunDev/brasscoders.

Copper Sun Brass Coders

AI-generated code drove 2.74× more CVEs in Q1 2026 (6 in January → 35 in March). The curve accelerates. Most teams' detection layers weren't built for this. Deterministic scanning catches what AI coders structurally miss. Read more → https://brss.fyi/1vdw

brss.fyiThe Q1 2026 AI-Code CVE ReckoningAI-generated code drove a 2.74× CVE increase in Q1 2026 — from 6 AI-attributed CVEs in January to 35 in March alone. A reading of what the data says about where deterministic detection needs to go.

Copper Sun Brass Coders

Your AI assistant wrote the bug. Its own patch check isn't real verification: the same model can sample a false all-clear. BrassCoders scans deterministically, your assistant patches, then a re-scan confirms the pattern is gone. Read more → https://brss.fyi/wrkb

brss.fyiScan, Patch, Re-Scan: Verifying AI Bug FixesBrassCoders closes the loop on AI-written bugs: scan for the finding, hand it to your assistant for a patch, then re-scan to confirm the fix deterministically.

Copper Sun Brass Coders

96 package names, one frontier AI model, checked live against PyPI. 95 real. 1 invented, lowercase and hyphenated, indistinguishable from the rest until you query the registry. Published research puts the blended rate at 19.7% across 16 models. It's never zero. Read more → https://brss.fyi/cqsv

brss.fyiAI Package Hallucination Rate: 96 Names Checked On PyPIBrassCoders ran a first-party probe: 96 package names a frontier AI model suggested for Python tasks, checked live against PyPI. 95 existed; 1 didn't.

Copper Sun Brass Coders

Q3 2026 data point: 45% of AI-generated code samples ship an OWASP Top 10 flaw. AI-assisted PRs carry 1.7x more issues than human-only ones. Nearly 1 in 5 AI-recommended packages doesn't exist. BrassCoders catches the structural share before merge. Read more → https://brss.fyi/ot0t

brss.fyiAI Code Defect Rates: The Q3 2026 Data ReportA dated, sourced snapshot of AI-generated-code defect and security rates for Q3 2026: 45% OWASP flaws, 1.7x issues per PR, 19.7% phantom packages. Refreshed quarterly.

Copper Sun Brass Coders

Wire a Claude Code hook to run brasscoders scan on every edit. .brass/ai_instructions.yaml stays current, Claude Code reads it as context, and you stop pasting scanner output into chat. One block in .claude/settings.json. Free, Apache 2.0 OSS core → https://brss.fyi/67hc

brss.fyiRun BrassCoders Automatically in a Claude Code HookWire a Claude Code hook to run brasscoders scan on every edit, so .brass/ai_instructions.yaml stays fresh and the assistant reads findings without copy-paste.

Copper Sun Brass Coders

A 2025 benchmark: LLM code reviewers hit 0.78-0.88 recall, beating static scanners. But precision sits at 0.72-0.78, all three models mislocate findings at the line level, and outputs vary run to run at temp zero. Great triage. Bad gate. Read more → https://brss.fyi/pyhp

brss.fyiLLM Code Reviewer Reliability, by the NumbersA 2025 benchmark puts LLM code-review recall at 0.78 to 0.88, yet the models mislocate findings and vary run to run — the numbers on why it's a weak gate.

Copper Sun Brass Coders

AI coding assistants reason within one file's context window. A SQL injection flowing across lib/db.ts, routes/api.ts, and lib/util/strings.ts stays invisible to the LLM. The taint path never reconstructs. The bug ships. Read more → https://brss.fyi/qx3z

brss.fyiThe Regression That Shouldn't Have ShippedAI coding assistants reason within a single file's context window and miss bugs whose taint flows across three or more files. The category that ships past AI-assisted review.

Copper Sun Brass Coders

AI coding assistants catch logic bugs. BrassCoders catches what they miss: cross-file taint, hardcoded secrets, hallucinated imports, performance anti-patterns. Run both layers. They're complementary, not competitors. Read more → https://brss.fyi/4rvd

brss.fyiCopilot Does X. BrassCoders Does Y.AI code review and deterministic static analysis are complementary layers, not competitors. The math of running both, the hand-off prompt, and when replacing one with the other is wrong.

Copper Sun Brass Coders

1,500 findings = 0 findings. Nobody reads that report. Detection isn't the bottleneck—ranking is. Brasscoders ranks findings so developers fix the 30 that matter, not the 1,500 that pile up. Read more → https://brss.fyi/1018

brss.fyiYour SAST Dashboard Has 1,500 FindingsA static-analysis report with 1,500 findings is functionally a report with zero findings — nobody reads it. The bottleneck is ranking, not detection.

Copper Sun Brass Coders

Auditors reject stochastic scanner output. They need deterministic, reproducible results tied to a commit. Brasscoders runs 12 deterministic scanners and emits audit-ready YAML your AI coding assistant can consume. Catch what your AI coder misses → https://brss.fyi/1az6

brss.fyiWhat Your Auditor Wants From Your AI CodebaseAuditors do not accept stochastic scanner output. Deterministic, reproducible, citation-ready YAML — the audit posture an AI-augmented engineering team needs by 2026.

Copper Sun Brass Coders

BrassCoders has no daemon or watcher. It scans only when something calls it. Getting it on every commit means wiring it into CI on push or a git pre-commit hook, both explained here. It exits code 1 on CRITICAL findings, which is what actually gates the build. Read more → https://brss.fyi/1yui

brss.fyiNew Guide: Running BrassCoders on Every CommitA new guide covers how to run BrassCoders on every commit — a CI step on push or a git pre-commit hook — and why there's no automatic watch mode. BrassCoders is a command-line scanner you invoke, not a background daemon.

Copper Sun Brass Coders

BrassCoders scans AI-generated code for bugs. But Copper Sun builds four other tools too: audio transcription, SEO audit, marketing campaign runner, goal coach. All five share one rule: do one job, stay out of your way, respect your data. Read more → https://brss.fyi/5xci

brss.fyiThe AI Tools Copper Sun Builds Besides BrassCodersBrassCoders is one of five AI tools from Copper Sun Content and Creative. Here are the other four, and why an engineer might actually want them.

Copper Sun Brass Coders

Bandit caught 6 of 12 planted AI-coder bugs in our benchmark. All 6 were security issues. It caught zero performance anti-patterns. The gap isn't Bandit's fault — it's scope. Bandit finds security bugs. Performance patterns need different scanners. Read more → https://brss.fyi/1d5n

brss.fyiWhy Bandit Catches 50% of AI-Coder Bugs (and Which Half)Bandit caught 6 of 12 planted bugs in BrassCoders's AI-coder benchmark — and 0 of the 4 performance anti-patterns AI coding assistants introduce most often. Here's why, and what to add alongside it.

Copper Sun Brass Coders

AI assistants invent package names 19.7% of the time. One hallucinated name drew 30k downloads when registered. BrassCoders flags unresolvable imports before pip install runs. Read more → https://brss.fyi/rk7p

brss.fyiCatching Hallucinated Imports Before pip installAI assistants invent package names that don't exist; one study found 19.7%. BrassCoders flags every unresolvable import before the install runs.

Copper Sun Brass Coders

AI models generate runnable examples with hardcoded keys. BrassCoders's SecretsScanner caught a HIGH-severity HMAC secret in AI-generated Python — confidence 0.85, impact 0.9. Two lines swapped it to os.environ.get(). Re-scan: zero credential findings. Read more → https://brss.fyi/9a30

brss.fyiFrom HIGH to Clean: Removing a Hardcoded HMAC Key in AI-Generated PythonA real before-and-after: BrassCoders's SecretsScanner finds a hardcoded HMAC signing key in a corpus Python file. The environment variable fix, the re-scan, and why detect-secrets catches this where Bandit alone misses some cases.

Copper Sun Brass Coders

Static analysis catches SQL injection, misses missing auth. BrassCoders maps the exact boundary: structural patterns vs context-dependent bugs. SQL injection lives in source code; auth requirements live in specs. Neither layer replaces the other. Read more → https://brss.fyi/z78d

brss.fyiWhat Static Analysis Cannot See: A Complete Map of the LimitSQL injection: caught. Missing auth on a route: not caught. BrassCoders maps the precise boundary between what static analysis detects deterministically and what requires an AI assistant's context.

Copper Sun Brass Coders

AI coders ship the same four perf bugs daily: O(N²) concat, insert-at-zero loops, triple-nested joins, unbounded polls. BrassCoders catches all four. Bandit and Pylint catch zero. Read more → https://brss.fyi/jl7q

brss.fyiFour Performance Bugs AI Coders Introduce Every DayA walkthrough of the four AI-coder performance anti-patterns BrassCoders catches that Bandit, Pylint, and a frontier model reviewer all miss: O(N²) string concat, insert-at-zero loops, triple-nested joins, and unbounded polls.

Copper Sun Brass Coders

Claude Opus generated a Flask endpoint with SQL injection. BrassCoders caught it in one scan—two CRITICAL findings plus Bandit—all pointing to line 22. The fix: swap string formatting for parameterized queries. One re-scan shows both CRITICALs gone. Read more → https://brss.fyi/x1f5

brss.fyiFrom SQL Injection to Clean: Fixing a B608 Finding in AI-Generated Flask CodeBefore-and-after walkthrough: BrassCoders finds SQL injection in a corpus Flask endpoint, the parameterized fix, and what the re-scan shows — including the one Semgrep taint finding that remains.