Why my security scanner refuses to tell you your code is clean
There is a failure mode in security tooling that almost nobody instruments for, and once you see it you cannot unsee it. An empty findings list looks identical to a clean result. A scanner that crashed halfway, a scanner whose API key expired, a scanner that ran out of budget, and a scanner that genuinely examined everything and found nothing — all four produce the same artifact: findings: [] .…
Many security scanners appear to deliver a clean result when they actually haven't run at all. An empty "findings: []" list can be mistaken for a successful scan, whether the scanner crashed, ran out of budget, or genuinely found no issues. This can give a false sense of security. The author built an application-security agent to address this problem.
The agent issues findings, which are then reviewed by an independent verifier that doesn't know the scanner's confidence level or severity. This prevents the verifier from being misled by high-confidence, critical findings. The agent was tested by planting fake findings against clean code, and the verifier correctly rejected the fabricated results.
The demo corpus has five vulnerable and five clean files that differ by one security-relevant change each. This allows measuring whether a tool identifies real issues while avoiding false positives in clean code. The author has tested their agent against their own runner and found a path traversal vulnerability, but has not benchmarked it against other security tools.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
