Search for a command to run...
Internal developer platforms turned "is this service production-ready?" into a scorecard question. gradepath answers it from a checkout alone - a weighted golden-path checklist that prints a grade and the exact gaps to close, with no platform, network, or AI.
LLM-as-judge has quietly become how teams score their AI - but when the same model writes an answer and grades it, self-preference bias inflates the number and you ship a regression on a score you can't trust. Here is why biased judges are an eval bug, and judgeskew, a static gate that fails the build before that score reaches a dashboard.
Broken Object Level Authorization has been OWASP's #1 API risk across two consecutive editions, and it's invisible to WAFs, schema validators, and most scanners - because the request is perfectly well-formed. Here's why BOLA is structurally different from injection, and what actually stops it in 2026.
A team ships a new "AI assistant" feature in March. By June, the GPU line item on the cloud bill is bigger than the entire rest of the infrastructure budget combined, nobody signed off on that, and fi
When a function-calling tool's input schema has no required list, open additionalProperties, or an untyped field, the model fills the gaps with hallucinated arguments. Here is why loose schemas are a correctness bug, and toolstrict, a static gate that fails the build before they ship.
Security reviews and the EU AI Act now ask a question most teams can't answer in one command: exactly which models, datasets, prompts and vector stores does this system depend on? Here is modelmuster - a deterministic, offline CLI that scans a project and emits a structured AI manifest of its whole AI supply chain. It never fails your build; it hands you the inventory.
Cost and carbon are two different rankings on the same usage export: a cheap region can be dirty, an expensive one clean. cinderscope reads the export you already have and estimates the kgCO2e of every row - no account access, no agents, nothing leaving your machine — then tells you which region to move.
A lapsed certificate is a preventable, self-inflicted outage — the expiry sits in a file nobody looks at until the pager fires. leafwatch parses your PEM/DER certs offline, sorts them by soonest expiry, flags the unhealthy ones, and gates CI. One Go binary, nothing leaves the machine.
A practical field guide to GitHub Actions vulnerabilities - script injection, privileged triggers, permissions/OIDC, supply chain - and how offline static analysis with actionward catches them before merge.
