Our engineers turned a codebase's own security-fix history into a map of where its next bug is likely to be. Worth reading if you run an AppSec program and your scanners only find known CVEs. chainloop.dev/blog/predictin…

We are testing Jev from @typesafeai at @chainloop_dev for security classification, and the results are better than I expected. The task is simple to explain. Go through the full commit history of a repo and ask one question per commit: was this a security fix? Then classify the vulnerability and give a confidence score. This is how we build the AI Security Context for every connected repo at Chainloop. Why is this useful? (more in our docs, linked in the comments) 1. Find regressions and first-party vulnerabilities with adversarial analysis. Your AI agents get this context when they write code, so they know where the codebase got burned before and can hunt for unpatched variants of old bugs. 2. Measure the security hygiene of a project over time. Every confirmed fix is dated and classified, so you get an honest record: how fast you patch, how long bugs stayed exposed, which classes keep coming back. 3. Audit evidence. That record holds up in audits and security reviews, and it is a good way to judge a codebase before you depend on it. DM me if you want to try it. ps. Policies are next. Most of our agentic policies are the same problem anyway: here is the evidence, here is the question, give me a verdict with a reason and a score.