Regex prefilters catch prompt-injection and unbounded-stream patterns; Bandit and Semgrep generate false positives on safe allowlist-then-run patterns because they don't track data provenance.
June 5, 2026
Summary
Existing Python SAST (Bandit, Semgrep) have zero AI-app-specific rules and flag safe patterns as vulnerable, forcing manual triage. getdebug fills the gap: 100% precision/recall on AI-specific fixtures, zero false positives on real code.
Why it matters
Existing Python SAST (Bandit, Semgrep) have zero AI-app-specific rules and flag safe patterns as vulnerable, forcing manual triage. getdebug fills the gap: 100% precision/recall on AI-specific fixtures, zero false positives on real code.
Implementation verdict
Complements rather than replaces Bandit and Semgrep. Run all three: `bandit -r .`, `semgrep --config auto .`, then `npx @getdebug/cli@0.4.0 analyze .`. Requires Node.js runtime for getdebug CLI. Worth trying now on Python LLM projects; optional Ollama integration for on-device LLM analysis.
Sources
Dev Signal
Get briefs like this in your inbox — free, every weekday.
100+ sources compressed into one 4-minute read. Ranked, cited, implementation-ready.