CNRT CodeLens
Most scanners hand back a list too long to work through and too noisy to trust. CodeLens is built around the two things that actually make a finding useful: checking its own work, and stopping short of changing your code without being asked.
size_t need = hdr->len + sizeof(tag_t); if (need > cap) { cap = need; } memcpy(buf, hdr->body, hdr->len); buf[hdr->len] = 0; return finalize(buf, need);}Unchecked bounds on copy path
Length comes from the caller and is used to write before it is compared against the destination size.
Proposed change, for your review
- memcpy(buf, hdr->body, hdr->len);+ if (hdr->len >= cap) return E_RANGE;+ memcpy(buf, hdr->body, hdr->len);A second model checks what the first one found
Every finding survives a second opinion.
Detection and verification are separate stages by design. The first pass reads the repository through several different lenses; a later stage takes each candidate finding and asks a different model whether it actually holds. What reaches you has survived being argued with, which is what makes a short list worth reading.
Unchecked bounds on copy path
Length reaches a write before it is compared against the destination size.
Reachable from two call sites that accept caller-controlled input. Holds.
A crash costs you one stage, not the whole scan
An interrupted scan resumes from its checkpoint.
A full pass over a large repository is long-running work, and long-running work fails. CodeLens checkpoints after each stage, so an interrupted scan picks up where it stopped rather than starting from nothing. On a large codebase that is the difference between a re-run and a lost afternoon.
It does not touch your code unless you ask
It reports, and waits.
Detection runs first and stops. Remediation is a separate, deliberate step you choose to take, per finding. Plenty of tools will open pull requests against your repository on their own; this one reports, and waits. Findings export as Markdown or PDF so they can go into a review or a report as they are.
Proposed change, for your review
} - memcpy(buf, hdr->body, hdr->len);+ if (hdr->len >= cap) return E_RANGE;+ memcpy(buf, hdr->body, hdr->len); buf[hdr->len] = 0;Built at Quantum Ventura.
Built at Quantum Ventura and sold on its own. It reads source code rather than network traffic, so it stands as its own product, and it reports into the CyberNeuro-RT dashboard for teams already running it.
| Position | Standalone product, integrated with the CNRT dashboard |
|---|---|
| Verification | Separate model pass over candidate findings |
| Recovery | Checkpoint and resume between stages |
| Output | Markdown and PDF |
| Interface | Multilingual, English and Japanese in place today |
Tell us the program
and the problem.
We reply from San Jose, usually within two working days.