Martin Monperrus

Go's security-critical infrastructure is riddled with thousands of cryptographic API misuses, and your favorite static analysis tool might be missing them.

Stop wasting time on irrelevant dependency vulnerabilities: FIKA dynamically proves which third-party library calls are *actually* reachable in your Java code.

Forget about chasing the perfect model architecture – this work suggests the real key to better AI agents lies in crafting more precise and complete specifications, since the implementation can always be re-generated.

Forget reproducible builds: zero-knowledge compilation offers cryptographic proof that your binary came from the claimed source code, blocking compiler substitution and source tampering.