My question would be are you using it on your own codebase or an open-source tool you're fond of, would love to see this operating in the wild (examples are great but real life PRs hit different)?
My question would be are you using it on your own codebase or an open-source tool you're fond of, would love to see this operating in the wild (examples are great but real life PRs hit different)?
We are using it on our codebases, and it's helped us secure our own product. Users have also been trying it out with their private codebases, and we even used our own personal projects to test it.
If you'd like to try Corgea with some open-source tools, there are a ton of applications that are vulnerable by design like. Some popular ones:
https://github.com/bkimminich/juice-shop https://github.com/we45/Vulnerable-Flask-App https://github.com/adeyosemanputra/pygoat
Edit: Forgot to mention, we've put in some controls to avoid hallucinations like comparing diff sizes between the two changes. Sometimes LLM's like to truncate code when generating a fix or generates too much. We actually stop the result from being generated and we retry again.