20:"$Sreact.view_transition" 21:I[9754,["/_next/static/chunks/2t36f5p4pjzlb.js","/_next/static/chunks/1gyqeidjm5eoa.js","/_next/static/chunks/0_fjnxc4tt_l_.js","/_next/static/chunks/1ymt1shyhmu-4.js","/_next/static/chunks/3kv2zf0i7s2wc.js","/_next/static/chunks/1vs_3g_g75zmk.js","/_next/static/chunks/2g4dh802s8oz3.js","/_next/static/chunks/1bc3f0shukf1j.js","/_next/static/chunks/192kgs9v_t14j.js","/_next/static/chunks/0z6pw0v5c_lx5.js","/_next/static/chunks/08r60e6icmtkc.js","/_next/static/chunks/3trx6c0i7_x-3.js","/_next/static/chunks/40sro5bzp9bi_.js","/_next/static/chunks/1wgf3tk38y6cf.js"],"ProjectDetail"] 22:T3a5d, Vibe Security Radar — 追踪 AI 代码引入的安全漏洞

Vibe Security Radar

每一条修复提交，都是指认引入者的证据。

这是来自佐治亚理工学院 SSLab 的研究项目：扫描公共漏洞公告，沿 blame 线溯回，追查那些由 AI 编写代码引入的真实 CVE。

■ 人工归属 ■ 盖印的 AI 工具签名 ■ 落在 blame 线上的判定

01 · 扫描面

先从公共公告面上扫一遍

阅读任何一条 blame 之前，Vibe Security Radar 会先从公开披露的数据库里收集候选漏洞——那里是公告对外发布的地方。

osv-advisory · gh-advisory · nvd / ingest

02 · 归属

git blame 把修复溯回给真正的引入者

对每一条修复提交，git blame 沿着提交历史，找出究竟是谁把有漏洞的那一行写进来的——把一次提交变成一个人、一串 commit 哈希。

fix-commit ad431c9 :: blame → introducer@732eff1

03 · 签名

从提交本身读出 AI 工具签名

工具会识别 AI 辅助留下的标记——co-author trailer、机器人邮箱、提交元数据——覆盖超过 15 种 AI 工具签名，而不是信任一个飘在上面的标签。

· co-author trailers ◆
· 机器人邮箱域名 ◆
· 提交元数据 ◆

04 · 判定

再由大语言模型确认因果链，而不只看元数据

签名检测只是第一遍。工具会在证据之上再做一次最终阅读，让「AI 编写」的判断建立在因果关系上，而不只是一行 trailer。

05 · 边界

对自己能看到的地板保持诚实

检测取决于提交留下了什么。没有痕迹的地方就无从指认——所以每一个上报的数量都是严格下限，而规模本身也带着真实成本。

严格下限

不留下提交签名的 AI 代码不可见；结果宁可少算，也不越界夸大。

规模与成本

一次完整运行要克隆约 1 万个仓库，需要 2TB 以上磁盘空间；项目仍在积极开发，结果可能包含错误。

06 · 源头

每一处都能溯到原始数据

项目与证据一起交付：来自 hq1995 的公开仓库，以及一张雷达的实时视图。

仓库 · github 实时雷达 · vibesecradar.com

雷达 · AI 编写归属 · 严格下限

23:T3c84, Vibe Security Radar — Tracking vulnerabilities from AI-written code

Vibe Security Radar

Every fix commit is evidence that names the introducer.

A research project from the Georgia Tech SSLab that tracks the real CVEs where AI-written code introduced the vulnerability — by scanning public advisory databases and reading the blame line.

■ human attribution ■ AI-tool signature stamped ■ verdict on the blame line

01 · surface

It sweeps the public advisory surface first

Before any blame is read, Vibe Security Radar collects candidate vulnerabilities from the databases where disclosures are published publicly.

osv-advisory · gh-advisory · nvd / ingest

02 · attribution

git blame traces the fix back to its introducer

For each fix commit, git blame walks the history to name who actually introduced the vulnerable line — turning a patch into a person and a commit hash.

fix-commit ad431c9 :: blame → introducer@732eff1

03 · signature

An AI-tool signature is read from the commit itself

The tool recognizes markers left by AI assistance — co-author trailers, bot mailboxes, and commit metadata — across more than 15 AI tool signatures, without trusting a floating label.

· co-author trailers ◆
· bot email domains ◆
· commit metadata ◆

04 · verdict

An LLM verifies the causal chain, not just the metadata

Signature detection is only the first pass. The tool runs a final read over the evidence so a claim of AI authorship holds on causality, not on a trailer alone.

05 · limits

Honest about the floor of what it can see

Detection depends on what a commit leaves behind. Where there is no trace, nothing is named — so every reported count is a strict lower bound, and scope carries real cost.

lower bound

AI code that leaves no commit signature is invisible; results undercount on purpose rather than overclaim.

scope & cost

A full run clones roughly 10,000 repositories and needs more than 2TB of disk. Under active development; output may contain errors.

06 · access

Data you can trace to the source

The project ships beside its evidence: a public repository from hq1995, and a live view of the radar.

repository · github live radar · vibesecradar.com

radar · AI-authored attribution only · strict lower bound

24:T520,The project's mechanism is forensic attribution: it scans advisory databases, then uses git blame to name which fix commit introduced a vulnerability, then detects AI tool signatures to credit AI-authored code. The Blame Line expresses that exact mechanism — a trace that bifurcates into authorship and ends in a verdict — rather than a generic marketing hero. The other two directions are genuinely distinct but weaker: the Lower-Bound Horizon captures the project's honesty about its strict lower bound and would be a strong secondary, yet it foregrounds coverage semantics over the attribution process; the Introducer Seam puts the fix↔introducer relationship first but risks reading as a left/right product comparison and leans closer to a dashboard-like split, which the brief forbids. The Blame Line also needs no media and no fake chrome — the ledger ruling and bifurcating blame type are self-sufficient against an empty assetManifest — and its ledger surface, strict attribution typography, and vertical mobile-stack recomposition differ materially from the other two directions' boundary-cartography and split-plane models. It avoids every forbidden default (metric cards, feature-card walls, fake terminal/browser/dashboard shells, glow-graphic substitution, non-recomposed stacked columns).a:[["$","$20",null,{"enter":{"secondary-forward":"secondary-forward","secondary-back":"secondary-back-enter","default":"none"},"exit":{"secondary-forward":"secondary-forward","secondary-back":"secondary-back-exit","default":"none"},"update":{"secondary-forward":"secondary-forward","secondary-back":"secondary-back-update","default":"none"},"default":"none","children":["$","$L21","cmt2zh0jl00qv6271tynbcndi:zh-CN:beautified",{"project":{"id":"cmt2zh0jl00qv6271tynbcndi","slug":"hq1995-vibe-security-radar","name":"vibe-security-radar","description":"追踪AI编写代码引入的真实CVE漏洞","authorName":"hq1995","authorVerification":{"verified":false,"verifiedAt":null},"category":"development_tools","subcategory":"data_ai_tools","experienceUrl":"https://vibesecradar.com/","qualityScore":72,"featured":false,"officialSite":null,"views":{"original":{"available":true},"official":{"available":false,"reason":"disabled_by_policy"},"beautified":{"available":true,"reason":null},"defaultView":"beautified"},"beautifiedView":{"revisionId":"cmt2zh0jy00r762719upaek7v","kind":"artifact","artifact":{"schemaVersion":"localized-static-html-v4","kind":"static_html","locales":["zh-CN","en"],"defaultLocale":"zh-CN","documents":{"zh-CN":"$22","en":"$23"},"designDirections":{"schemaVersion":"dodot-design-directions-v1","directions":[{"id":"dir-blame-line","name":"The Blame Line","projectMetaphor":"Forensic authorship ledger over git history — every fix commit is evidence that names the introducer.","signatureVisual":"A single horizontal type line that splits down its middle into attribution branches; an AI-tool signature is stamped onto one branch as an embedded inline mark (not a floating badge).","heroGeometry":"One long horizontal trace segment whose tokens progressively bifurcate into attribution lines, each credited to an author before a verdict mark lands at the end.","sectionSequence":["premise","scanning-surface","blame-attribution","ai-signature-detection","causal-verdict","limits","source-access"],"surfaceModel":"Paper ledger surface: fine horizontal ruling lines, crisp ink type, single accent ink for the AI attribution, no gradients or glow.","palette":"Warm paper cream base, near-black ink, one red-orange accent reserved exclusively for AI-authored attribution.","typography":"Humanist serif for narrative headings, monospace for attributions and evidence lines, generous leading.","desktopComposition":"Left-anchored reading column with the blame line running across, evidence lines aligned to a strict left grid; verdict marks on the right edge.","mobileTransformation":"Single-column scroll where the attribution branches stack vertically and each author line becomes its own tappable node instead of a left-flush ledger.","mediaStrategy":"No media region; the blame-line trace and attribution ledger are the only visual matter; evidence set in monospace type.","forbiddenPatterns":["no fake commit-diff terminal shell","no hero title followed by metric cards","no feature-card wall with interchangeable copy"],"compositionFingerprint":"ledger-ruling-lined-trace-bifurcating-into-attribution"},{"id":"dir-lower-bound-horizon","name":"The Lower-Bound Horizon","projectMetaphor":"Radar coverage that is honest about its boundary — only what leaves a trace is detectable; the stated number is a strict floor.","signatureVisual":"A horizontal coverage bar where the detectable region ends at an explicit boundary, and the bounded segment is labeled as the strict lower bound rather than a complete account.","heroGeometry":"An asymptotic coverage horizon: a dense detectable band that clearly terminates, with the area beyond the boundary held blank to show unreachability.","sectionSequence":["premise","scanning-surface","trace-dependency","lower-bound-statement","scope-and-cost","source-access"],"surfaceModel":"Survey / boundary cartography surface: flat field, thin contour lines only where coverage is real, blank space used as truthful absence.","palette":"Cool slate and white field, one cyan used only to mark covered bands, blank space left untouched.","typography":"Geometric sans for datum labels, tabular figures for the bound, minimal sans for narrative.","desktopComposition":"Wide horizontal band reading left to right where coverage accumulates then stops; boundary marking sits on a top-aligned datum line across the viewport.","mobileTransformation":"Coverage band becomes a stacked set of segmented survey strips read vertically, boundary rendered as a clear end-stop per strip instead of one wide horizon.","mediaStrategy":"No media region; the coverage-boundary horizon and blank-space absence are the sole visual matter.","forbiddenPatterns":["no radar sweep glow or particle field","no pseudo-chart bars masquerading as metrics","no three metric cards after the hero"],"compositionFingerprint":"coverage-band-horizon-terminating-at-explicit-boundary"},{"id":"dir-introducer-seam","name":"The Introducer Seam","projectMetaphor":"The seam where a vulnerability's fix exposes the introducer — a flip between two commit states.","signatureVisual":"A fault line joining two opposing commit markers: the vulnerable state and the fix state, stitched by a git-blame seam with the AI-signature motif embedded at the seam node.","heroGeometry":"Two opposing panels (before / after) connected by a diagonal seam whose vertex carries the AI authorship stamp.","sectionSequence":["premise","fix-reveals-introducer","signature-catalog","llm-verification","caveats","source-access"],"surfaceModel":"Stitched tectonic surface: two split planes with a literal seam, hard edges, minimal elevation, no glass or shadow wash.","palette":"Split warm and cool planes opposing one another, a single high-contrast mark at the seam vertex.","typography":"Strong condensed sans for state labels, monospace for commit hashes and signatures at the seam.","desktopComposition":"A fixed split viewport: vulnerable plane left, fix plane right, shared seam band running diagonally between them carrying evidence.","mobileTransformation":"The two planes become stacked layers revealed in sequence on scroll, the seam rendered as a connecting strip rather than a diagonal split.","mediaStrategy":"No media region; the two-plane seam and embedded signature moti are the only visual matter.","forbiddenPatterns":["no editor or diff-pane shell that impersonates a product screenshot","no decorative seam glow","no hero-plus-three-cards layout"],"compositionFingerprint":"split-planes-joined-by-blame-seam-vertex-stamped"}],"selectedDirectionId":"dir-blame-line","selectionRationale":"$24"},"designBrief":{"schemaVersion":"dodot-design-brief-v1","selectedDirectionId":"dir-blame-line","projectMetaphor":"Forensic authorship ledger over git history — every fix commit is evidence that names the introducer.","signatureVisual":"A single horizontal type line that splits down its middle into attribution branches; an AI-tool signature is stamped onto one branch as an embedded inline mark (not a floating badge).","compositionFingerprint":"ledger-ruling-lined-trace-bifurcating-into-attribution","heroGeometry":"One long horizontal trace segment whose tokens progressively bifurcate into attribution lines, each credited to an author before a verdict mark lands at the end.","sectionSequence":["premise","scanning-surface","blame-attribution","ai-signature-detection","causal-verdict","limits","source-access"],"surfaceModel":"Paper ledger surface: fine horizontal ruling lines, crisp ink type, single accent ink for the AI attribution, no gradients or glow.","palette":"Warm paper cream base, near-black ink, one red-orange accent reserved exclusively for AI-authored attribution.","typography":"Humanist serif for narrative headings, monospace for attributions and evidence lines, generous leading.","desktopComposition":"Left-anchored reading column with the blame line running across, evidence lines aligned to a strict left grid; verdict marks on the right edge.","mobileTransformation":"Single-column scroll where the attribution branches stack vertically and each author line becomes its own tappable node instead of a left-flush ledger.","mediaStrategy":"No media region; the blame-line trace and attribution ledger are the only visual matter; evidence set in monospace type.","evidencePlan":["Datum vs evidence mapping: each section ties to extraction.facts and summary.localizations claims (description, scanning OSV/GitHub Advisory/NVD, git blame tracing introducers, 15+ AI tool signatures, LLM causal verification, strict lower bound on metadata, Georgia Tech SSLab origin, ~10k repos and 2TB+ full-run).","Signature visual driven by mechanism: the bifurcating blame line renders the verified fix-commit→introducer→AI-signature chain, never a fake product screenshot, chart, dashboard, or terminal shell.","No media region: assetManifest is empty, so the artifact contains no image frames and never loads a remote runtime image; visual matter is evidence-driven type and ruling only.","Locale contract honored without invented facts: zh-CN and en share the same section sequence while copy stays natural per language and every claim is confined to summary/localizations evidence."],"localeContract":{"zh-CN":"使用自然的中文技术叙述（serif 标题渲染为指定中文字体），罪名/签名/判定等证据行保持人工校对的可读密度，所有事实验证于 summary.localizations.zh-CN。","en":"Natural English technical narration; evidence lines and signature catalog kept concise and auditable, all claims confined to summary.localizations evidence."},"forbiddenPatterns":["no fake commit-diff terminal shell","no hero title followed by metric cards","no feature-card wall with interchangeable copy","no browser, phone, terminal, dashboard, or editor shells without direct evidence","no decorative gradients, glows, grids, or particles substituting for the attribution idea","no stacked desktop columns on mobile without recomposition"]},"visualReview":{"schemaVersion":"dodot-automated-design-review-v1","status":"approved","summary":"The zh-CN and en pages faithfully implement the selected dir-blame-line direction. Both hero sequences render the brief's signature visual — a single horizontal blame trace that bifurcates into attribution branches with the AI-tool signature stamped as an inline mark on one branch and a verdict landing at the end — as an inline SVG with no media/fake shell. All narrative claims map to material.json summary/localizations evidence (Georgia Tech SSLab, OSV/GitHub Advisory/NVD scan, git blame attribution, 15+ AI signatures, LLM causal verification, strict lower bound, ~10k repos / 2TB+). Surface model follows the paper-ledger contract: cream paper ground, near-black ink, a single red-orange accent used only for AI attribution, fine ruling lines, no gradients/glow/grid substitution. Both locales share the same 7-section sequence with natural, equivalent copy. Layout recomposes on mobile (single-column sections, stacked grids, non-left-flush). No blocking issues found.","checks":{"projectFit":{"passed":true,"evidence":"Both files implement material.json project 'vibe-security-radar' (AI-written-code CVE tracking). zh-CN.html:77 & en.html:87 H1 equals the forensic ledger metaphor; hero-lede names Georgia Tech SSLab and CVE tracking exactly per summary. Section sequence premise→scanning-surface→blame-attribution→ai-signature-detection→causal-verdict→limits→source-access matches design-brief sectionSequence; 7 sections in both (qa-report sectionCount 7)."},"evidenceBound":{"passed":true,"evidence":"Every factual claim traces to material.json: SSLab origin (summary evidence claim z=3; zh:78/en:88), scanning OSV/GitHub Advisory Database/NVD (zh:29/en:44), git blame traces introducers (zh:40/en:55), 15+ AI tool signatures (zh:52/en:67), LLM verification of causality (zh:80/en:95), strict lower bound on commit metadata (zh:94/en:109), ~10k repos and 2TB+ full run (zh:102/en:117), author hq1995 (zh:115/en:130). Repo URL and vibesecradar.com anchors match projection.experienceUrl/homepageUrl (zh:117-118/en:132-133). Sample hashes ad431c9/732eff1 are presented as an illustrative mechanism trace, not real CVE data."},"signatureVisual":{"passed":true,"evidence":"Hero SVG in both files (zh:81-210/en:91-225) is a single horizontal type line (M250,52 L430,42 / L430,82) that splits into two attribution branches; the AI branch carries an inline 'signature · co-authored-by' mark and 'ai-attributed' label (zh:202/en:216), and a verdict lands on a vertical blame line (zh:208 '判定 → AI 编写' / en:223 'VERDICT → AI-authored'). Cap list legend and aria-label confirm the stamp-not-badge intent; no floating badge or floating glow decoration."},"mobileTransformation":{"passed":true,"evidence":"@media (max-width:780px) in both files (zh:151-160/en:160-170) collapses .section-head to a single column (grid-template-columns:1fr, .right-edge grid-column:1), stacks .limits-grid to 1fr, reduces padding, and lets .blame-row scroll horizontally — a true recomposition rather than a shrink of a left-flush ledger. The qa-report mobile metrics confirm scrollWidth==clientWidth at 390px (no horizontal overflow) and 7 sections present. Minor deviation: the hero trace SVG scales to fit rather than being re-authored into individually tappable attribution nodes as the brief's mobileTransformation text suggests."},"localeParity":{"passed":true,"evidence":"zh-CN.html and en.html share the identical section sequence and count (both h2Count 6, sectionCount 7 per qa-report). Copy is translated naturally per language (zh keeps 'git blame', 'co-author trailer', 'AI 工具签名'; en uses idiomatic 'Every fix commit is evidence that names the introducer'). Each claim in one locale has an equivalent, naturally-worded counterpart in the other (e.g. limits 严格下限/lower bound, 规模与成本/scope & cost). No invented facts differ between locales."},"antiTemplate":{"passed":true,"evidence":"Selected direction dir-blame-line is honored; the project did not regress to a generic hero+metric cards, feature-card wall, or card grid. No browser/phone/terminal/dashboard/editor shell exists (both files contain no such chrome; media is limited to inline mechanism SVGs). The .ruling-bg repeating-linear-gradient is the brief's specified fine ledger ruling surface, not a decorative gradient/grid substitution; there are no glows, particles, or decorative gradient meshes, and no media region/image frames (assetManifest is empty)."},"noFakeUi":{"passed":true,"evidence":"The only interactive elements are two real anchor links (github.com/hq1995/vibe-security-radar and vibesecradar.com) with rel noopener in each locale; all other UI is static diagram/ledger type. qa-report fakeControlCount=0 and emptyLinkCount=0 across all four viewport runs. SVG markers and signature labels are mechanism illustration, not fake controls; verdict banners and ev-lists are non-interactive reading matter."}},"issues":[{"code":"hero-mobile-not-reauthored","severity":"warning","locale":"all","description":"The brief's mobileTransformation says attribution branches should stack vertically and each author line become its own tappable node; on mobile the hero trace SVG merely scales to fit width instead of being recomposed into stacked, individually addressable attribution nodes.","repairInstruction":"On narrow viewports, re-render the hero bifurcation as stacked monospace attribution rows (one per branch) with the AI signature inline on its row, rather than scaling the horizontal SVG."}]},"repairEvidence":[{"attempt":1,"before":{"qaPassed":false,"designReviewApproved":false,"qaEvidence":{"zh-CN":[{"viewport":"desktop","passed":true,"localePassed":true,"metrics":{"language":"zh-CN","h1Count":1,"h2Count":6,"sectionCount":7,"textLength":1162,"cjkCount":542,"latinLetterCount":314,"scrollWidth":1280,"clientWidth":1280,"scrollHeight":3764,"h1Top":202.046875,"bottomInset":216.359375,"brokenImageCount":0,"missingAltCount":0,"fakeControlCount":0,"emptyLinkCount":0},"screenshotHashes":{"top":"da110d0e14bdc15aa59bfbe4decd5489c592b484c4ffe1c2be98e68534a20812","middle":"f1dc4e36fde59c4361d7ce710043e12a2f4ed22ec7f0805d50eb3b0d6b71cd0e","bottom":"8162315f8caa044fb0429901cf69391de11c97687dc9fba1b45645ff7c88c65e"},"consoleErrors":[],"networkRequests":[]},{"viewport":"mobile","passed":true,"localePassed":true,"metrics":{"language":"zh-CN","h1Count":1,"h2Count":6,"sectionCount":7,"textLength":1162,"cjkCount":542,"latinLetterCount":314,"scrollWidth":390,"clientWidth":390,"scrollHeight":3687,"h1Top":138.046875,"bottomInset":192.328125,"brokenImageCount":0,"missingAltCount":0,"fakeControlCount":0,"emptyLinkCount":0},"screenshotHashes":{"top":"1c0e14c6745a741fa5f943222ab3cf85de87150b7145c17c3caf83047f9fd1eb","middle":"0a3a5ed167f69bc00eb82fe02af2f3d9f7c8c57156a5731105050b6a635df3d5","bottom":"d5f52323635783f62fe33b7a0c861ff6de9b62d5e34a88f1a71fd318c411bea7"},"consoleErrors":[],"networkRequests":[]}],"en":[{"viewport":"desktop","passed":true,"localePassed":true,"metrics":{"language":"en","h1Count":1,"h2Count":6,"sectionCount":7,"textLength":2387,"cjkCount":0,"latinLetterCount":1839,"scrollWidth":1280,"clientWidth":1280,"scrollHeight":3904,"h1Top":200.09375,"bottomInset":215.609375,"brokenImageCount":0,"missingAltCount":0,"fakeControlCount":0,"emptyLinkCount":0},"screenshotHashes":{"top":"d1899c7f882fa672ca35b9b5a34054709d41a4211b82e3be3a6a637352158874","middle":"8b6f012df9b50b1826534d267a0d5de70b46e1b718a9b2093903bd8f80291d69","bottom":"cc640596bc79db3708cf0754b5854833374af3fa506d35f97096215fddbbe06b"},"consoleErrors":[],"networkRequests":[]},{"viewport":"mobile","passed":false,"localePassed":true,"metrics":{"language":"en","h1Count":1,"h2Count":6,"sectionCount":7,"textLength":2387,"cjkCount":0,"latinLetterCount":1839,"scrollWidth":456,"clientWidth":390,"scrollHeight":3992,"h1Top":136.09375,"bottomInset":192.4375,"brokenImageCount":0,"missingAltCount":0,"fakeControlCount":0,"emptyLinkCount":0},"screenshotHashes":{"top":"cb5e2fd1c450a70f8dd37f537d3a5935da63347d3d6f9e0081ed56a122b192cd","middle":"2964a4cd573438e50b549bb0a552c1798c44ba89c20618cc036aaf4b6c144ec2","bottom":"af6e2bdb59ea0e5df6cd989fee911d904393cc24024c959b09a098f8bfb4c840"},"consoleErrors":[],"networkRequests":[]}]},"visualReview":null},"after":{"qaPassed":true,"designReviewApproved":true,"qaEvidence":{"zh-CN":[{"viewport":"desktop","passed":true,"localePassed":true,"metrics":{"language":"zh-CN","h1Count":1,"h2Count":6,"sectionCount":7,"textLength":1162,"cjkCount":542,"latinLetterCount":314,"scrollWidth":1280,"clientWidth":1280,"scrollHeight":3764,"h1Top":202.046875,"bottomInset":216.359375,"brokenImageCount":0,"missingAltCount":0,"fakeControlCount":0,"emptyLinkCount":0},"screenshotHashes":{"top":"da110d0e14bdc15aa59bfbe4decd5489c592b484c4ffe1c2be98e68534a20812","middle":"f1dc4e36fde59c4361d7ce710043e12a2f4ed22ec7f0805d50eb3b0d6b71cd0e","bottom":"8162315f8caa044fb0429901cf69391de11c97687dc9fba1b45645ff7c88c65e"},"consoleErrors":[],"networkRequests":[]},{"viewport":"mobile","passed":true,"localePassed":true,"metrics":{"language":"zh-CN","h1Count":1,"h2Count":6,"sectionCount":7,"textLength":1162,"cjkCount":542,"latinLetterCount":314,"scrollWidth":390,"clientWidth":390,"scrollHeight":3506,"h1Top":138.046875,"bottomInset":192.078125,"brokenImageCount":0,"missingAltCount":0,"fakeControlCount":0,"emptyLinkCount":0},"screenshotHashes":{"top":"c839193e63eb3df5baceec2b9962a66aa89e37c573d030ddc1cc93cd5933ad5b","middle":"82a763ba01fcc5d594961bbfb386ca3620853242e15a11d5eaae8a1b9d7e0033","bottom":"ff3d3ca2df9f471addeeed7d68b076ec4cbff9e8130c75abe659a0b4342cc7ad"},"consoleErrors":[],"networkRequests":[]}],"en":[{"viewport":"desktop","passed":true,"localePassed":true,"metrics":{"language":"en","h1Count":1,"h2Count":6,"sectionCount":7,"textLength":2387,"cjkCount":0,"latinLetterCount":1839,"scrollWidth":1280,"clientWidth":1280,"scrollHeight":3904,"h1Top":200.09375,"bottomInset":215.609375,"brokenImageCount":0,"missingAltCount":0,"fakeControlCount":0,"emptyLinkCount":0},"screenshotHashes":{"top":"d1899c7f882fa672ca35b9b5a34054709d41a4211b82e3be3a6a637352158874","middle":"8b6f012df9b50b1826534d267a0d5de70b46e1b718a9b2093903bd8f80291d69","bottom":"cc640596bc79db3708cf0754b5854833374af3fa506d35f97096215fddbbe06b"},"consoleErrors":[],"networkRequests":[]},{"viewport":"mobile","passed":true,"localePassed":true,"metrics":{"language":"en","h1Count":1,"h2Count":6,"sectionCount":7,"textLength":2387,"cjkCount":0,"latinLetterCount":1839,"scrollWidth":390,"clientWidth":390,"scrollHeight":3919,"h1Top":136.09375,"bottomInset":191.984375,"brokenImageCount":0,"missingAltCount":0,"fakeControlCount":0,"emptyLinkCount":0},"screenshotHashes":{"top":"cb5e2fd1c450a70f8dd37f537d3a5935da63347d3d6f9e0081ed56a122b192cd","middle":"27f15a7497a081ff66aad8f3504e03f9e526da4fd2ab815e623ddb457afd3eb1","bottom":"34dc9e5c07271b1ffeca0b83025faa006c8f51e74645bfc33e0c0071571bd2c1"},"consoleErrors":[],"networkRequests":[]}]},"visualReview":{"schemaVersion":"dodot-automated-design-review-v1","status":"approved","summary":"The zh-CN and en pages faithfully implement the selected dir-blame-line direction. Both hero sequences render the brief's signature visual — a single horizontal blame trace that bifurcates into attribution branches with the AI-tool signature stamped as an inline mark on one branch and a verdict landing at the end — as an inline SVG with no media/fake shell. All narrative claims map to material.json summary/localizations evidence (Georgia Tech SSLab, OSV/GitHub Advisory/NVD scan, git blame attribution, 15+ AI signatures, LLM causal verification, strict lower bound, ~10k repos / 2TB+). Surface model follows the paper-ledger contract: cream paper ground, near-black ink, a single red-orange accent used only for AI attribution, fine ruling lines, no gradients/glow/grid substitution. Both locales share the same 7-section sequence with natural, equivalent copy. Layout recomposes on mobile (single-column sections, stacked grids, non-left-flush). No blocking issues found.","checks":{"projectFit":{"passed":true,"evidence":"Both files implement material.json project 'vibe-security-radar' (AI-written-code CVE tracking). zh-CN.html:77 & en.html:87 H1 equals the forensic ledger metaphor; hero-lede names Georgia Tech SSLab and CVE tracking exactly per summary. Section sequence premise→scanning-surface→blame-attribution→ai-signature-detection→causal-verdict→limits→source-access matches design-brief sectionSequence; 7 sections in both (qa-report sectionCount 7)."},"evidenceBound":{"passed":true,"evidence":"Every factual claim traces to material.json: SSLab origin (summary evidence claim z=3; zh:78/en:88), scanning OSV/GitHub Advisory Database/NVD (zh:29/en:44), git blame traces introducers (zh:40/en:55), 15+ AI tool signatures (zh:52/en:67), LLM verification of causality (zh:80/en:95), strict lower bound on commit metadata (zh:94/en:109), ~10k repos and 2TB+ full run (zh:102/en:117), author hq1995 (zh:115/en:130). Repo URL and vibesecradar.com anchors match projection.experienceUrl/homepageUrl (zh:117-118/en:132-133). Sample hashes ad431c9/732eff1 are presented as an illustrative mechanism trace, not real CVE data."},"signatureVisual":{"passed":true,"evidence":"Hero SVG in both files (zh:81-210/en:91-225) is a single horizontal type line (M250,52 L430,42 / L430,82) that splits into two attribution branches; the AI branch carries an inline 'signature · co-authored-by' mark and 'ai-attributed' label (zh:202/en:216), and a verdict lands on a vertical blame line (zh:208 '判定 → AI 编写' / en:223 'VERDICT → AI-authored'). Cap list legend and aria-label confirm the stamp-not-badge intent; no floating badge or floating glow decoration."},"mobileTransformation":{"passed":true,"evidence":"@media (max-width:780px) in both files (zh:151-160/en:160-170) collapses .section-head to a single column (grid-template-columns:1fr, .right-edge grid-column:1), stacks .limits-grid to 1fr, reduces padding, and lets .blame-row scroll horizontally — a true recomposition rather than a shrink of a left-flush ledger. The qa-report mobile metrics confirm scrollWidth==clientWidth at 390px (no horizontal overflow) and 7 sections present. Minor deviation: the hero trace SVG scales to fit rather than being re-authored into individually tappable attribution nodes as the brief's mobileTransformation text suggests."},"localeParity":{"passed":true,"evidence":"zh-CN.html and en.html share the identical section sequence and count (both h2Count 6, sectionCount 7 per qa-report). Copy is translated naturally per language (zh keeps 'git blame', 'co-author trailer', 'AI 工具签名'; en uses idiomatic 'Every fix commit is evidence that names the introducer'). Each claim in one locale has an equivalent, naturally-worded counterpart in the other (e.g. limits 严格下限/lower bound, 规模与成本/scope & cost). No invented facts differ between locales."},"antiTemplate":{"passed":true,"evidence":"Selected direction dir-blame-line is honored; the project did not regress to a generic hero+metric cards, feature-card wall, or card grid. No browser/phone/terminal/dashboard/editor shell exists (both files contain no such chrome; media is limited to inline mechanism SVGs). The .ruling-bg repeating-linear-gradient is the brief's specified fine ledger ruling surface, not a decorative gradient/grid substitution; there are no glows, particles, or decorative gradient meshes, and no media region/image frames (assetManifest is empty)."},"noFakeUi":{"passed":true,"evidence":"The only interactive elements are two real anchor links (github.com/hq1995/vibe-security-radar and vibesecradar.com) with rel noopener in each locale; all other UI is static diagram/ledger type. qa-report fakeControlCount=0 and emptyLinkCount=0 across all four viewport runs. SVG markers and signature labels are mechanism illustration, not fake controls; verdict banners and ev-lists are non-interactive reading matter."}},"issues":[{"code":"hero-mobile-not-reauthored","severity":"warning","locale":"all","description":"The brief's mobileTransformation says attribution branches should stack vertically and each author line become its own tappable node; on mobile the hero trace SVG merely scales to fit width instead of being recomposed into stacked, individually addressable attribution nodes.","repairInstruction":"On narrow viewports, re-render the hero bifurcation as stacked monospace attribution rows (one per branch) with the AI signature inline on its row, rather than scaling the horizontal SVG."}]}},"changedFiles":["artifact/zh-CN.html","artifact/en.html"]}],"provenance":{"executor":"opencode","model":"deepseek/deepseek-v4-flash","opencodeVersion":"1.1.58","promptVersion":"dodot-showcase-deepseek-v4","inputHash":"451657ccdbf444cbcdf330abb3cb5668ba29066c7c9bdd1c565bc011e176433e","artifactHash":"ecfab96cc48a5621d8040bbf8181061e0396dc1761c94914d61443f2c6b91f0e","designSkill":"dodot-showcase-design"},"qaEvidence":{"zh-CN":[{"viewport":"desktop","passed":true,"localePassed":true,"metrics":{"language":"zh-CN","h1Count":1,"h2Count":6,"sectionCount":7,"textLength":1162,"cjkCount":542,"latinLetterCount":314,"scrollWidth":1280,"clientWidth":1280,"scrollHeight":3764,"h1Top":202.046875,"bottomInset":216.359375,"brokenImageCount":0,"missingAltCount":0,"fakeControlCount":0,"emptyLinkCount":0},"screenshotHashes":{"top":"da110d0e14bdc15aa59bfbe4decd5489c592b484c4ffe1c2be98e68534a20812","middle":"f1dc4e36fde59c4361d7ce710043e12a2f4ed22ec7f0805d50eb3b0d6b71cd0e","bottom":"8162315f8caa044fb0429901cf69391de11c97687dc9fba1b45645ff7c88c65e"},"consoleErrors":[],"networkRequests":[]},{"viewport":"mobile","passed":true,"localePassed":true,"metrics":{"language":"zh-CN","h1Count":1,"h2Count":6,"sectionCount":7,"textLength":1162,"cjkCount":542,"latinLetterCount":314,"scrollWidth":390,"clientWidth":390,"scrollHeight":3506,"h1Top":138.046875,"bottomInset":192.078125,"brokenImageCount":0,"missingAltCount":0,"fakeControlCount":0,"emptyLinkCount":0},"screenshotHashes":{"top":"c839193e63eb3df5baceec2b9962a66aa89e37c573d030ddc1cc93cd5933ad5b","middle":"82a763ba01fcc5d594961bbfb386ca3620853242e15a11d5eaae8a1b9d7e0033","bottom":"ff3d3ca2df9f471addeeed7d68b076ec4cbff9e8130c75abe659a0b4342cc7ad"},"consoleErrors":[],"networkRequests":[]}],"en":[{"viewport":"desktop","passed":true,"localePassed":true,"metrics":{"language":"en","h1Count":1,"h2Count":6,"sectionCount":7,"textLength":2387,"cjkCount":0,"latinLetterCount":1839,"scrollWidth":1280,"clientWidth":1280,"scrollHeight":3904,"h1Top":200.09375,"bottomInset":215.609375,"brokenImageCount":0,"missingAltCount":0,"fakeControlCount":0,"emptyLinkCount":0},"screenshotHashes":{"top":"d1899c7f882fa672ca35b9b5a34054709d41a4211b82e3be3a6a637352158874","middle":"8b6f012df9b50b1826534d267a0d5de70b46e1b718a9b2093903bd8f80291d69","bottom":"cc640596bc79db3708cf0754b5854833374af3fa506d35f97096215fddbbe06b"},"consoleErrors":[],"networkRequests":[]},{"viewport":"mobile","passed":true,"localePassed":true,"metrics":{"language":"en","h1Count":1,"h2Count":6,"sectionCount":7,"textLength":2387,"cjkCount":0,"latinLetterCount":1839,"scrollWidth":390,"clientWidth":390,"scrollHeight":3919,"h1Top":136.09375,"bottomInset":191.984375,"brokenImageCount":0,"missingAltCount":0,"fakeControlCount":0,"emptyLinkCount":0},"screenshotHashes":{"top":"cb5e2fd1c450a70f8dd37f537d3a5935da63347d3d6f9e0081ed56a122b192cd","middle":"27f15a7497a081ff66aad8f3504e03f9e526da4fd2ab815e623ddb457afd3eb1","bottom":"34dc9e5c07271b1ffeca0b83025faa006c8f51e74645bfc33e0c0071571bd2c1"},"consoleErrors":[],"networkRequests":[]}]}},"generatorVersion":"opencode-1.1.58:deepseek/deepseek-v4-flash:dodot-showcase-deepseek-v4","publishedAt":"2026-08-20T05:57:33.245Z"},"rawExtraction":{"projectRevisionId":"cmt2zh0jr00r16271s44dw169","projectVersion":1,"sources":[{"canonicalKey":"github:hq1995/vibe-security-radar","role":"primary","revisionVersion":1,"url":"https://github.com/HQ1995/vibe-security-radar"}],"facts":[{"key":"repository_owner","value":"hq1995","evidence":[{"path":"repository.owner","excerpt":"hq1995"}]},{"key":"repository_name","value":"vibe-security-radar","evidence":[{"path":"repository.name","excerpt":"vibe-security-radar"}]},{"key":"description","value":"Tracking vulnerabilities contributed by AI-written code","evidence":[{"path":"repository.description","excerpt":"Tracking vulnerabilities contributed by AI-written code"}]},{"key":"primary_language","value":"Python","evidence":[{"path":"repository.language","excerpt":"Python"}]},{"key":"source_count","value":"1","evidence":[{"path":"projectRevision.sources","excerpt":"github:hq1995/vibe-security-radar"}]}],"taxonomy":{"category":"development_tools","subcategory":"data_ai_tools","confidence":0.65,"evidence":[{"path":"repository.description","excerpt":"Tracking vulnerabilities contributed by AI-written code"}]},"lifecycle":{"stage":"active","confidence":0.75,"evidence":[{"path":"repository.pushedAt","excerpt":"2026-08-15T16:06:39.000Z"}]},"userIntents":[{"slug":"build_software","label":"构建或改进软件","confidence":0.65,"evidence":[{"path":"repository.description","excerpt":"Tracking vulnerabilities contributed by AI-written code"}]},{"slug":"automate_work","label":"自动化工作流程","confidence":0.65,"evidence":[{"path":"repository.description","excerpt":"Tracking vulnerabilities contributed by AI-written code"}]},{"slug":"create_content","label":"创作内容或设计","confidence":0.65,"evidence":[{"path":"repository.description","excerpt":"Tracking vulnerabilities contributed by AI-written code"}]},{"slug":"analyze_data","label":"分析与理解数据","confidence":0.65,"evidence":[{"path":"repository.description","excerpt":"Tracking vulnerabilities contributed by AI-written code"}]}],"readme":{"headings":["Vibe Security Radar","Quick Start","1. Set up","2. Run batch analysis (full run needs ~2TB disk)","3. Generate web data and preview","How It Works","Contributing","License"],"commands":[]},"changeSet":[{"field":"repository","beforeHash":"7d8ac99a7f635e1a9b6ff868548d2a62b3541e95b395b063e84fd2ee1a52ffd7","afterHash":"ef97f69ab4de53507c9dc63a7815d96a76546d2a69dfd7275b5df4fe315ad2cc"}]},"publishedAt":"2026-08-16T12:39:36.983Z","updatedAt":"2026-08-21T13:26:50.652Z","summary":{"id":"cmt2zh0ju00r362718lhfuunx","projectType":"product","oneLine":"追踪AI编写代码引入的真实CVE漏洞","overview":"Vibe Security Radar 是一个研究项目，通过扫描OSV、GitHub Advisory Database和NVD等公共公告数据库，利用git blame追踪漏洞引入者，并检测AI工具签名（如co-author trailers、bot邮箱）来识别由AI生成代码导致的安全漏洞。它提供CLI工具和Web界面，帮助安全研究人员了解AI代码的安全影响。","highlights":["扫描多个漏洞数据库","git blame追踪引入者","检测15+AI工具签名","LLM验证因果关系"],"bestFor":["安全研究人员","AI代码安全评估","漏洞研究"],"caveats":["检测依赖提交元数据，结果可能不完整","完整运行需要2TB+磁盘空间","项目处于积极开发中，结果可能包含错误"],"categorySuggestion":"development_tools","subcategorySuggestion":"data_ai_tools","lifecycleStages":["testing_quality","deployment_growth"],"audienceIntents":["discover","learn","evaluate"],"confidence":0.7,"evidence":[{"claim":"该项目追踪由AI编写代码引入的真实CVE漏洞。","sourceType":"description","locator":"https://github.com/HQ1995/vibe-security-radar"},{"claim":"它扫描OSV、GitHub Advisory Database和NVD等公共公告数据库，并通过git blame追踪修复提交。","sourceType":"readme","locator":"https://github.com/HQ1995/vibe-security-radar"},{"claim":"检测依赖提交元数据，并非所有AI辅助代码都会留下痕迹，因此数字是严格下限。","sourceType":"readme","locator":"https://github.com/HQ1995/vibe-security-radar"},{"claim":"该项目来自佐治亚理工学院SSLab，属于研究项目。","sourceType":"readme","locator":"https://github.com/HQ1995/vibe-security-radar"},{"claim":"完整运行需要克隆约1万个仓库，磁盘空间需求超过2TB。","sourceType":"readme","locator":"https://github.com/HQ1995/vibe-security-radar"}],"publishedAt":"2026-08-17T13:25:57.948Z"},"github":{"url":"https://github.com/HQ1995/vibe-security-radar","ownerAvatarUrl":"https://avatars.githubusercontent.com/u/7395848?v=4","starsCount":107,"forksCount":9,"language":"Python","syncedAt":"2026-08-17T13:22:48.588Z","license":null,"defaultBranch":"main","archived":false,"disabled":false,"lastChangedAt":"2026-08-15T16:06:39.000Z","missing":false},"tags":[],"updates":[]},"entryPoint":"discovery","claim":{"state":"unclaimed","verified":false},"initialView":"beautified","community":{"viewer":null,"state":{"likesCount":0,"creativeCount":0,"followersCount":0,"commentsCount":0,"liked":false,"creative":false,"followed":false},"comments":{"comments":[],"nextCursor":null}}}]}],"$L25"]