{
  "id": 3634755,
  "title": "I invented a CVE number to test my tool. It was real",
  "url": "https://urgent.news/2026/08/27/i-invented-a-cve-number-to-test-my-tool-it-was-real",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-08-27T01:26:24.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/dgotlieb/i-invented-a-cve-number-to-test-my-tool-it-was-real-3di1"
  },
  "original_language": "en",
  "account": "A developer invented a CVE number to test their tool, which checks if claims in a bug report correspond to actual code in a repository. The fabricated report contained a fake CVE number, a fake file, a fake function, and a fake commit hash. The tool incorrectly marked the fabricated CVE as real, showing that it was focusing on whether the identifier existed rather than if it was relevant to the specific project. This issue highlights the challenge maintainers face when dealing with bug reports and security disclosures that reference non-existent code, as they have to carefully read through each claim to identify any inaccuracies. The tool aims to address this problem by extracting checkable claims from reports, resolving them against the repository at the specified revision, and reporting any mismatches. The developer acknowledges that the tool does not evaluate authorship or make judgments about the report's origin, and that some misses in documentation are expected and not necessarily false positives.",
  "summary": "I've been building a thing that checks whether the claims in a bug report correspond to anything that exists. Not whether the report is AI-generated — whether the file it names is in the repository, whether the function is declared, whether the version was ever tagged. To test it end to end I wrote a deliberately fabricated security report against one of my own projects. Fake file, fake function,…",
  "key_points": [
    "Developer created fake CVE number for testing purposes",
    "Tool incorrectly marked fabricated CVE as real",
    "Issue highlights challenge of dealing with non-existent code"
  ],
  "editors_take": "The test's unexpected outcome reveals a shortcoming in the tool's design, indicating it prioritizes identifier existence over relevance to the specific project, potentially complicating efforts to validate bug reports.",
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}