Engineering notes from the team building the engine

The blog.

No launch announcements. Just how the analysis actually works, what breaks in practice, and the trade-offs we made.

Articles: 9 published
Focus: AST & security
Cadence: Monthly
Authors: Engineering team

Security

October 12, 2026

9 min

Top 7 OWASP Vulnerabilities Pattern-Matching Linters Miss

Single-file linters miss flaws that span file boundaries. Here are 7 critical OWASP vulnerabilities only whole-codebase taint tracking can catch.

ScanDrix Engineering · AST Engine Team

Engineering

October 8, 2026

7 min

How to Build an Automated AST Security Gate in GitHub Actions

How to configure a sub-minute deterministic AST security gate in GitHub Actions that blocks vulnerabilities before merge without slowing down CI.

ScanDrix Engineering · Platform & CI/CD

Engineering

September 29, 2026

8 min

Why AI Reviewers Hallucinate on Cross-File Diffs (And the Fix)

Why feeding raw git diffs to LLMs causes hallucinated bugs, and how compiling full AST syntax trees gives models the ground truth they need.

ScanDrix Engineering · AI Engine Team

Guides

April 15, 2026

8 min

8 Best SonarQube Alternatives for Modern Engineering Teams (2026)

Tired of slow CI build times and false positives? Explore the 8 best SonarQube alternatives for code quality, security, and AI review in 2026.

ScanDrix Research · Static Analysis & SAST Team

Product

April 14, 2026

9 min

7 Best CodeRabbit Alternatives for AI Code Review in 2026 (Tested & Ranked)

Looking for a CodeRabbit alternative? We compared the top 7 AI code review tools across AST accuracy, cross-file reasoning, VPC hosting, and pricing.

ScanDrix Research · AI & DevTools Architecture

Security

March 18, 2026

7 min

Why Linters Miss Cross-File Vulnerabilities

Pattern matching is excellent inside a single file and structurally blind across files. Here is the concrete shape of the problem, and what actually fixes it.

ScanDrix Engineering · AST Engine Team

Engineering

March 4, 2026

9 min

Cross-File Taint Tracking in a Monorepo

How cross-package dependencies in monorepos break naive linters, and how inverse-importer AST graphs keep taint analysis fast and accurate.

ScanDrix Engineering · AST Engine Team

Guides

February 19, 2026

6 min

Dry-Run Your Rules Before You Enforce Them

Shipping a new lint rule to an entire organisation on day one is how you get a rule disabled by Friday. Here is the rehearsal-first workflow we recommend.

ScanDrix Engineering · Developer Experience

Product

February 3, 2026

8 min

BYOK LLM Routing for Security Reviews

Bringing your own model key is a privacy decision with real architectural consequences. What changes in the review pipeline, and what does not.

ScanDrix Engineering · Platform