Research & writing
Security research, tool post-mortems, and threat modeling from the Hedgerow team.
Closing the Seam: Cross-File Taint Analysis Without the Pro License
How we layered repository-wide, cross-file taint analysis on top of OpenGrep’s intra-file engine, so the bug that lives between two files stops being invisible. SCC-converged propagation, parameter-indexed summaries, an incremental cache, and the day the benchmark caught a zero that was impossible.
Read →“Trust Me” Is Not a Finding: The Taint Microkernel
If frontier models are this good, why build a taint engine at all? Because a model can describe a vulnerability beautifully but can’t hand you a reproducible, auditable proof. Put the deterministic engine at the center as the kernel and let the model ride shotgun as the coprocessor.
Read →How a Working Exploit Made Me Forget How to Threat Model
When your scanner is faster than your threat model. A post-mortem on submitting a high-severity RCE report, getting it closed as expected behavior, and what we actually missed in the process.
Read →No posts under that topic yet.