CodeCrucible: A blueprint for LLM-driven SAST engineering.block.xyz ↗

Clinton Carpene and colleagues on Block’s CodeCrucible: instead of pre-filtered snippets, it concatenates the whole repo into one call, since “if no rule fires, the LLM never sees the code.” On a Linux CVE it flagged the flaw in seven minutes for $9, but missed the exploit chain.