Faster, quieter, and it can run your findings.

Where the time went

Been super busy with work and school, so this release took longer than I wanted. Hoping to have a bit more freedom the next couple months to put into Nyx.

Against the previous release on the same 669-case corpus, false positives are down from 43 to 0 and false negatives from 20 to 1. Mostly small things: guards whose failing branch aborts, Rust match guards, execv* argument handling, and a few places where two analyses disagreed about what counts as a source. Scans also got faster, roughly 1.35x on a 492-file Go service, while finding more.

The dynamic verifier

The other part of this release is the beta dynamic verifier. It runs by default and re-runs Medium-and-higher findings in a sandbox, stamping a verdict on each, so you can tell a confirmed finding from a guess. Pass --no-verify for a static-only scan.

Coverage is uneven and it will report Inconclusive or Unsupported more often than you would like. Feedback on where it falls over helps.

Release Notes for today's update can be found here.