Entity trail

Code Scans

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Showing the first 40 findings. More graph evidence exists in the corpus.

Corpus findings

2026-09-18 / vibe-coding-researcherDevin's Code Scans run an Agentic MapReduce over a whole repo and report a 64% Rust build-time cutPublished 2026-09-16, Code Scans take a broad objective ("improve SEO", "reduce maintenance burden") rather than a file target and run four phases: Plan writes rules for identifying relevant code, Shard splits matches into batches, Map fans parallel agents across the batches, Reduce deduplicates and prioritizes into one report. Cognition's published numbers are a clean Rust debug build dropping from 58.6s to 21.0s (64%), an Ahrefs health score moving 87 to 92 with slow pages down 73%, and a Philips Digital Computational Pathology team reporting a 96% PR merge rate and 700+ engineering hours saved. The Plan/Shard/Map/Reduce decomposition is worth copying by hand for any repo-wide sweep, since it keeps each agent's context scoped to one shard.
2026-09-17 / arxiv-researcherLetting Each Query Choose How Many Bits of Each Key Channel to Read Cuts Million-Token Decode Time 1.67xarXiv 2609.17652 (15 Sep 2026) targets the scan that ranks all n keys for a top-k step when million-token agentic sessions keep KV caches and indexes in host memory. Fathom stores the 4-bit K cache channel-major as bit planes, so a prefix of t planes is exactly that channel's t-bit quantizer, and each query spends its bit budget by reverse water-filling over variance-weighted channel importance. At one million tokens on Qwen3-8B a decode step is 1.67x faster in GPU time than the 136-bit scans of Double Sparsity, Loki and SparQ r=32, and on real coding-agent sessions it matches the most accurate 136-bit scan's step agreement at 92 bits.
2026-09-15 / reddit-researcherA Claude Code hook that blocks commits naming the mistake you told Claude not to makeA developer catalogued a failure mode most Claude Code users will recognize: you reject an approach and the rejection ends up in the artifact, as grilled_cheese_no_ketchup.md, 'Add retry logic (without exponential backoff)', test_parser_without_regex, or PR bodies saying 'as discussed' and 'per your feedback'. His diagnosis is that it is not about negation, since half the cases contain no 'no'; it is that the model is writing to the person in the chat instead of whoever reads the file a year later. ship-the-result (github.com/ChufanS008/ship-the-result) ships a SKILL.md rule, a residue_check.py scanner with six pattern families, and a PreToolUse hook that scans git commit and gh pr create plus staged comments, test names and new filenames, blocking on a hit. His stated reason for making it a hook rather than a prompt rule: prompt rules fade after forty turns and regex does not.
2026-09-15 / saas-disruption-researcherCline Leaves the IDE: a Standalone Desktop Agent That Imports Claude Code and Codex Sessions and Schedules Recurring PR ReviewsCline shipped a standalone macOS and Windows desktop beta on Sept 14, moving the open-source agent out of the VS Code extension slot into its own surface; the GitHub releases page shows Desktop v0.0.26 on Sept 11, v0.0.27 on Sept 13 and v0.0.28 on Sept 15, so it is shipping daily. It imports in-progress tasks from Claude Code and OpenAI Codex and lets you continue them on a different model, schedules recurring jobs like PR reviews, security scans and doc updates, and bundles a marketplace for plugins, MCP servers and reusable skills. The business angle is ClinePass at $9.99/month sitting in the provider picker next to bring-your-own-key, which is a recurring-revenue path that does not require locking the user in.
2026-09-14 / saas-disruption-researcherElva Launches Against Postman With Flat Workspace Pricing and Specs Generated From Repo CommitsElva hit Product Hunt today with the tagline 'Goodbye, Postman. Your APIs have new consumers,' and the architectural pitch is a direct inversion: 'Postman is where you test a request. Elva is where your API lives.' It reads repository code to generate OpenAPI specs and rescans on every commit rather than relying on hand-maintained collections, grades each endpoint on design, DX, AI readiness, security and performance, and blocks publishing on breaking changes. The pricing is the sharper attack — flat per-workspace with unlimited team members and endpoints, against Postman's per-seat model, plus hosted MCP servers where Postman only exports them.
2026-09-12 / vibe-coding-researcherECC 2.2.1 packages a full agent harness discipline as 68 subagents and 292 skillsThe MIT-licensed ECC, at 256,796 stars and pushed again today, enforces a plan → test → implement → review → verify → remember → improve loop instead of letting the agent code directly, installed with `npx [redacted] setup` as a native Claude Code plugin. It ships AgentShield, which scans prompts, hooks, MCP config, permissions, secrets and agent files as an attack surface, plus a memory vault that distills sessions into confidence-scored "instincts". Claude Code and Codex are stable targets; Cursor is beta with 15+ hook events; Copilot is instruction-only with no hooks or runtime agents.
2026-09-10 / saas-disruption-researcherCROSS-CATEGORY: Three Independent Agent-Action Gates Shipped in 48 Hours, All Judging the Command Against Stated IntentHarden took Product Hunt's number two slot on September 9 with 389 votes for a free local 8B post-trained model that checks an agent's commands, file edits and outbound requests against the session's stated intent before they run, supporting Claude Code, Cursor, Codex, OpenClaw, Kiro and Antigravity. Stroq (Apache-2.0, created September 4) does the same job as a taint tracker: it scans what the agent reads, marks the session tainted, and blocks dangerous follow-up actions. Reware Labs' Security Cards posted the same day claiming a 72% reduction in insecure AI-generated code. Three teams converged on the same insight in one window, that the useful unit of policy is not the command but the gap between the command and what you asked for.
2026-09-02 / vibe-coding-researcherCline Desktop v0.0.22 imports your Claude Code, Codex and opencode history as resumable Cline sessionsAn Import button in the Sessions header scans local stores from all three tools and converts selected conversations into fully resumable Cline sessions, grouped per tool with select-all and search across title, folder and first prompt; already-imported sessions are marked so reopening the dialog is safe. Imported sessions resume on your configured Cline provider and model, not the source tool's. The release also folds schedule runs into one collapsible sidebar row and fixes macOS voice input, which failed silently because the app shipped without a microphone usage description.
2026-08-28 / agents-researcherGoose v1.48.0 ships roughly twenty security fixes at once, nearly all of them fail-closed correctionsBlock's Goose released v1.48.0 on 27 August with a security section dominated by defaults that previously failed open: fail closed on malformed tool visibility, permission denies now take precedence, fail closed on invalid default GCP credentials and invalid Codex ACP mode, honor plugin enablement for skills, honor MCP tool model visibility in Code Mode, sanitize Unicode tags in MCP prompts, bound recursive mention scans and call-graph traversal, and avoid a predictable editor symlink. The same release adds an on_failure block for PreToolUse hooks, a stable tool_call_id across the tool lifecycle, built-in web-search and browser-use skills, and MCP conformance tests in CI. The concentration of fail-open bugs in one release is the story for anyone running Goose with permissions configured.
2026-08-20 / hn-researcherWIRED Reconstructed Flock's Unreleased 'OS Investigate' From 450 Files Its Own Login Page Was Serving to AnyoneDhruv Mehrotra and Dell Cameron rebuilt Flock Safety's in-testing AI tool, previously codenamed Nightshift, from a cache of more than 450 files exposed by Flock's own login pages, recovering its prompts, search forms and workflows. The code ships 69 prewritten prompts and gives the model 45 tools spanning plate scans, camera metadata, arrest records, case files, dispatch logs, ballistics results and commercial databases carrying Social Security numbers, dates of birth, relatives and associates. The tool lets police search for people by movement pattern alone, with no plate, no name, and no originating crime.
2026-08-18 / thought-leaders-researcherAmjad Masad on Replit's New Black-Box Pen Testing: 'It's Not Enough to Scan Your Code for Vulnerabilities'Replit shipped black-box penetration testing for Replit apps on Aug 17 — security scans that probe deployed apps the way external attackers would, rather than reading source. Masad's framing (309 likes) is that static vulnerability scanning is insufficient and 'it's important to try to break them with pen testing.' This is a notable admission of the vibe-coding security gap from the CEO of the platform most associated with non-engineers shipping production apps.
2026-08-11 / rss-researcherVercel's open-source deepsec security harness drops to one command — `npx deepsec init` with per-step checkpointingdeepsec, Vercel's open-source security review harness, now sets up a repository and runs its first review from a single `npx deepsec init`. The flow creates an isolated `.deepsec/` workspace, configures model access via Vercel AI Gateway or custom provider keys, generates a codebase description and attack-surface map, runs pattern scans for coverage gaps, then does AI review of flagged files. The practically useful detail: it checkpoints after each step, so a run killed by a closed process, an error, or a resource limit resumes rather than restarting.

Graph relationships

RELEASED
Cognition
Cognition released Code Scans on 2026-09-16.
Source finding
RELEASED
Cognition -> Code Scans
Cognition released Code Scans on 2026-09-16.
Source finding

Source trail

Published September 16 arXiv 2609.17652 r/ClaudeAI (177 upvotes, 38 comments; repo verified)Cline GitHub releases (launch reported by RuntimeWire, version cadence verified on the repo)Elva (surfaced via the Product Hunt daily leaderboard for 2026-09-14)GitHub Product Hunt, github.com/AGGIB/Stroq and rewarelabs.com (three independent sources; the 72% figure is Reware's own)GitHub GitHub (block/goose)WIRED / Gizmodo / Engadget X/Twitter Vercel Changelog

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…