VulnSAGE preprint reports 104 reproduced defects from security scanner alerts

Researchers report in a preprint that VulnSAGE, a system for checking software security alerts, reproduced 104 defects at runtime after examining 45,440 alerts from five scanning tools across the 200 most-starred C/C++ projects on GitHub. Maintainers confirmed 24 of the 26 defects they responded to, including ten previously unknown defects; nine of those are already fixed. The system retrieves code dependencies relevant to each alert, records a language model's interpretations, and checks their premises through program analysis. In a separate evaluation of 187 labeled reports, it rejected 89 of 97 false alarms and retained 85 of 90 real defects.