# Hyrax

> Hyrax reads the entire codebase, runs a multi-agent audit to find bugs and security issues, executes the fix through a 13-step verification pipeline, and opens a pull request you review and merge. Clean code in. Clean PRs out.

This file is a machine-readable index of hyrax.dev (359 pages). Each link points to a canonical page on the site.

## Core

- [Hyrax — Clean code in. Clean PRs out.](https://hyrax.dev/)
- [Platform](https://hyrax.dev/platform)
- [Pricing](https://hyrax.dev/pricing)
- [Sample Audit](https://hyrax.dev/sample-audit)
- [FAQ](https://hyrax.dev/faq)
- [Learn](https://hyrax.dev/learn)
- [Blog](https://hyrax.dev/blog)
- [Compare Hyrax](https://hyrax.dev/compare)
- [Contact](https://hyrax.dev/contact)
- [Legal](https://hyrax.dev/legal)
- [Privacy Policy](https://hyrax.dev/legal/privacy)
- [Terms of Service](https://hyrax.dev/legal/terms)

## Solutions

- [For CTOs](https://hyrax.dev/solutions/cto)
- [For Engineering Leads](https://hyrax.dev/solutions/engineering-leads)
- [For Platform Engineers](https://hyrax.dev/solutions/platform-engineers)
- [For Software Engineers](https://hyrax.dev/solutions/software-engineers)
- [For Security Teams](https://hyrax.dev/solutions/security-teams)
- [For DevSecOps](https://hyrax.dev/solutions/devsecops)
- [For Fintech](https://hyrax.dev/solutions/fintech)
- [For Healthtech](https://hyrax.dev/solutions/healthtech)
- [For Ecommerce](https://hyrax.dev/solutions/ecommerce)
- [For SaaS](https://hyrax.dev/solutions/saas)
- [For Startups](https://hyrax.dev/solutions/startups)
- [For Scaleups](https://hyrax.dev/solutions/scaleups)

## Comparisons

- [Hyrax vs CodeRabbit](https://hyrax.dev/compare/coderabbit)
- [Hyrax vs Greptile](https://hyrax.dev/compare/greptile)
- [Hyrax vs Qodo](https://hyrax.dev/compare/qodo)
- [Hyrax vs Graphite](https://hyrax.dev/compare/graphite)
- [Hyrax vs Bugbot](https://hyrax.dev/compare/bugbot)
- [Hyrax vs Baz](https://hyrax.dev/compare/baz)
- [Hyrax vs Claude Code review](https://hyrax.dev/compare/claude-code-review)
- [Hyrax vs Copilot code review](https://hyrax.dev/compare/copilot-code-review)
- [Hyrax vs Codex code review](https://hyrax.dev/compare/codex-code-review)
- [Hyrax vs Snyk](https://hyrax.dev/compare/snyk)
- [Hyrax vs SonarQube](https://hyrax.dev/compare/sonarqube)
- [Hyrax vs Semgrep](https://hyrax.dev/compare/semgrep)
- [Hyrax vs Codacy](https://hyrax.dev/compare/codacy)
- [Hyrax vs Qodana](https://hyrax.dev/compare/qodana)
- [Hyrax vs Aikido](https://hyrax.dev/compare/aikido)
- [Hyrax vs Cursor](https://hyrax.dev/compare/cursor)
- [Hyrax vs Devin](https://hyrax.dev/compare/devin)
- [Hyrax vs Factory AI](https://hyrax.dev/compare/factory-ai)
- [Hyrax vs GitHub Copilot](https://hyrax.dev/compare/copilot)
- [Hyrax vs Claude Code](https://hyrax.dev/compare/claude)
- [Hyrax vs Codex](https://hyrax.dev/compare/codex)
- [Hyrax vs Windsurf](https://hyrax.dev/compare/windsurf)
- [Hyrax vs Augment](https://hyrax.dev/compare/augment)
- [CodeRabbit vs Qodo vs Hyrax: Compared, Head to Head (2026)](https://hyrax.dev/compare/coderabbit-vs-qodo)
- [CodeRabbit vs GitHub Copilot vs Hyrax: Compared, Head to Head (2026)](https://hyrax.dev/compare/coderabbit-vs-copilot)
- [Snyk vs SonarQube vs Hyrax: Compared, Head to Head (2026)](https://hyrax.dev/compare/snyk-vs-sonarqube)
- [CodeRabbit vs Hyrax: Compared, Head to Head (2026)](https://hyrax.dev/compare/coderabbit-vs-hyrax)
- [Qodo vs Hyrax: Compared, Head to Head (2026)](https://hyrax.dev/compare/qodo-vs-hyrax)
- [SonarQube vs Hyrax: Compared, Head to Head (2026)](https://hyrax.dev/compare/sonarqube-vs-hyrax)
- [Snyk vs Hyrax: Compared, Head to Head (2026)](https://hyrax.dev/compare/snyk-vs-hyrax)
- [GitHub Copilot vs Hyrax: Compared, Head to Head (2026)](https://hyrax.dev/compare/github-copilot-vs-hyrax)
- [Augment Code vs Hyrax: Compared, Head to Head (2026)](https://hyrax.dev/compare/augment-vs-hyrax)
- [Baz vs Hyrax: Compared, Head to Head (2026)](https://hyrax.dev/compare/baz-vs-hyrax)
- [Pixee vs Hyrax: Compared, Head to Head (2026)](https://hyrax.dev/compare/pixee-vs-hyrax)

## Blog Categories

- [Code Health — Articles](https://hyrax.dev/blog/code-health)
- [Security — Articles](https://hyrax.dev/blog/security)
- [Platform & Tooling — Articles](https://hyrax.dev/blog/platform-and-tooling)
- [AI in Engineering — Articles](https://hyrax.dev/blog/ai-in-engineering)
- [Architecture & Systems — Articles](https://hyrax.dev/blog/architecture-and-systems)
- [Engineering Leadership — Articles](https://hyrax.dev/blog/engineering-leadership)

## Blog Posts

- [Fable 5.1 and Mythos 5.1: What Tiered Access Means for Code Review](https://hyrax.dev/blog/fable-5-1-mythos-tiered-access-code-review)
- [GitSpawn: Your AI Coding Agent Runs Attacker Code on Repo Open](https://hyrax.dev/blog/gitspawn-git-config-rce-ai-coding-agents)
- [Fable 5.1's Cache Cut Changes the Economics of Agent Code Review](https://hyrax.dev/blog/fable-5-1-cache-cut-agent-code-review-economics)
- [OpenAI Astra Hits Critical Cyber Threshold: What It Means for Your Repo](https://hyrax.dev/blog/openai-astra-critical-cyber-threshold)
- [Anthropic's Compliance API Logs Claude Code Sessions , Half a Story](https://hyrax.dev/blog/anthropic-compliance-api-claude-code-identity-gap)
- [Velocity Is Not Excellence](https://hyrax.dev/blog/velocity-is-not-excellence)
- [Two GitHub Copilot Defaults Your Legal Team Hasn't Seen](https://hyrax.dev/blog/github-copilot-silent-defaults-retention-balanced)
- [Rubber Duck Confirms What Scan-Time Review Still Has to Do](https://hyrax.dev/blog/vs-code-rubber-duck-and-scan-time-review)
- [56% Pass Rate, Two Years Flat: The AI SDLC Security Gap](https://hyrax.dev/blog/56-percent-pass-rate-two-years-flat-ai-sdlc-security-gap)
- [OpenAI Cuts Cursor Off Nov 12 , De-Risk Your AI Coding Stack](https://hyrax.dev/blog/openai-cuts-cursor-november-12-derisking-ai-coding-stack)
- [Claude Unified Memory Changes What Your Agents Actually Know](https://hyrax.dev/blog/claude-unified-memory-agents-md-audit-trail)
- [Ransomware Affiliate Used Claude Code to Plan Intrusions Across Six Orgs](https://hyrax.dev/blog/ransomware-crew-used-cursor-active-directory-escalation)
- [When AI Coding Budgets Break: What Uber's Cap Means for Eng Teams](https://hyrax.dev/blog/ai-coding-budget-caps-uber-enterprise-rate-limiting)
- [AI Coding Assistants: Who Reviews and Fixes What They Write](https://hyrax.dev/blog/ai-coding-assistants-review-and-fix)
- [Slack Code Moves Code Review Into Chat. Governance Breaks.](https://hyrax.dev/blog/slack-code-governance-gap)
- [AISI's Agents Went Off-Script: 19 Unsanctioned Actions in 122 Runs](https://hyrax.dev/blog/aisi-agents-unsanctioned-actions-supply-chain)
- [When the PR Is the Wrong Artifact to Review](https://hyrax.dev/blog/intent-md-agent-sdlc-review-failure-modes)
- [CodeRabbit vs Qodo vs Hyrax: why code-writing agents shouldn't grade their own work](https://hyrax.dev/blog/coderabbit-vs-qodo-vs-hyrax)
- [96% Distrust AI Code. Only 48% Actually Check It.](https://hyrax.dev/blog/sonar-2026-ai-code-trust-behavior-gap)
- [Cursor Origin and the End of the PR Page as Review Surface](https://hyrax.dev/blog/cursor-origin-agent-native-hosting-review-layer)
- [When the Fix Is Another Agent: Replit's Black-Box Pen Tests](https://hyrax.dev/blog/replit-black-box-pen-tests-agent-remediation)
- [DeepSeek Harness Admits Prompt Injection by Design](https://hyrax.dev/blog/deepseek-harness-prompt-injection-by-design)
- [When Agents Fight: Anthropic's Multi-Agent Malware Problem](https://hyrax.dev/blog/anthropic-multi-agent-turf-war-malware)
- [Torvalds Concedes the Review Layer to AI: What Linux 7.2 Signals](https://hyrax.dev/blog/torvalds-linux-72-ai-review-new-normal)
- [Simpler Pricing: Two Plans, One Meter](https://hyrax.dev/blog/new-pricing)
- [CodeRabbit's $1.5B Valuation and What It Means for Code Review](https://hyrax.dev/blog/coderabbit-series-c-review-layer-market)
- [Hyrax vs. Qodo, Cursor BugBot, and CodeRabbit: who originates the work](https://hyrax.dev/blog/hyrax-vs-qodo-cursor-bugbot-coderabbit)
- [The Review Gap Is Now Measurable: 22,000 Developers, 861% Churn](https://hyrax.dev/blog/review-gap-measurable-faros-ai-telemetry-2026)
- [CLAUDE.md Sprawl: The Math That Explains Why Nobody Prunes](https://hyrax.dev/blog/claude-md-sprawl-append-vs-delete)
- [Go Is Good for AI Review. What About Everything Else?](https://hyrax.dev/blog/go-ai-review-other-stacks)
- [Governance reporting for automated code remediation: audit trails and compliance](https://hyrax.dev/blog/governance-reporting-code-remediation)
- [Claude's Global Watermark: What It Means for Your Codebase](https://hyrax.dev/blog/claude-watermark-code-provenance)
- [OpenAI Halted Astra: The First Capability-Gated Model Release](https://hyrax.dev/blog/openai-astra-capability-gate-cyber-threshold)
- [Claude Code Goes Auto-Default Aug 14: Humans Caught 13.6%](https://hyrax.dev/blog/claude-code-auto-mode-default-august-14)
- [Hyrax vs Semgrep: scanner findings vs verified fixes](https://hyrax.dev/blog/hyrax-vs-semgrep)
- [OpenAI Paused Astra for Crossing a Cyber Capability Line](https://hyrax.dev/blog/openai-astra-critical-cyber-threshold-pause)
- [August 2026: AI Coding Agent RCEs Are Now a Pattern](https://hyrax.dev/blog/august-2026-ai-coding-agent-rce-pattern)
- [The Agentic SDLC: Where Review and Remediation Fit](https://hyrax.dev/blog/agentic-sdlc-review-remediation)
- [Best CodeRabbit Alternatives in 2026](https://hyrax.dev/blog/coderabbit-alternatives-2026)
- [Hyrax vs Greptile: Review Comments vs Verified Fixes](https://hyrax.dev/blog/hyrax-vs-greptile)
- [The IDE is now the model: what vertical integration means for code review](https://hyrax.dev/blog/ide-vendor-vertical-integration-code-review)
- [Shieldstral: a 3B policy engine your PR pipeline can actually use](https://hyrax.dev/blog/shieldstral-3b-policy-engine-for-pr-pipelines)
- [The AISI Mythos 5 Incident: A Code Review Problem](https://hyrax.dev/blog/aisi-mythos-5-supply-chain-social-engineering)
- [CI throughput up 59%, main-branch success at 70.8%: the 2026 paradox](https://hyrax.dev/blog/ci-throughput-up-main-branch-success-falling-2026)
- [Security alert fatigue: how verified fixes cut the noise](https://hyrax.dev/blog/security-alert-fatigue-verified-fixes)
- [Best AI Vulnerability Scanners in 2026](https://hyrax.dev/blog/best-ai-vulnerability-scanners-2026)
- [Fake SQLite CVEs Rated 9.8 Critical Made It Into NVD](https://hyrax.dev/blog/fake-sqlite-cves-poisoned-nvd)
- [The Hyrax MCP server is live](https://hyrax.dev/blog/hyrax-mcp-server)
- [Tricentis Buys Tabnine: Code Gen and Quality Are Merging](https://hyrax.dev/blog/tricentis-tabnine-code-gen-quality-merger)
- [AI code checker: how to validate AI-generated code before it ships](https://hyrax.dev/blog/ai-code-checker)
- [AppSec governance and compliance platform comparison](https://hyrax.dev/blog/appsec-governance-compliance-platform-comparison)
- [Automated code refactoring: shrinking technical debt with verified fixes](https://hyrax.dev/blog/automated-code-refactoring)
- [Automated security remediation](https://hyrax.dev/blog/automated-security-remediation)
- [Best AI code review tools in 2026](https://hyrax.dev/blog/best-ai-code-review-tools-2026)
- [Best automated code remediation platforms in 2026](https://hyrax.dev/blog/best-automated-code-remediation-platforms)
- [Code remediation in CI/CD: fixing issues inside the pipeline](https://hyrax.dev/blog/code-remediation-in-cicd)
- [66.5% Bypass Rate: What Three Papers Say About Agent Security](https://hyrax.dev/blog/coding-agent-guardrail-bypass-research-2026)
- [GitHub Copilot's August 26 Deadline: Configure Model Policies Now](https://hyrax.dev/blog/github-copilot-august-26-model-policy-deadline)
- [Hyrax vs CodeRabbit: review comments vs verified fixes](https://hyrax.dev/blog/hyrax-vs-coderabbit)
- [How verified fixes earn trust: remediation accuracy and validation](https://hyrax.dev/blog/remediation-accuracy-and-validation)
- [How autonomous remediation closes the loop on scanner findings](https://hyrax.dev/blog/scanners-plus-autonomous-remediation)
- [Vibe coding security: how to keep AI-built apps safe to ship](https://hyrax.dev/blog/vibe-coding-security)
- [Claude Code's silent context: why the same prompt drifts between runs](https://hyrax.dev/blog/claude-code-silent-context-drift-ci-vs-laptop)
- [DeepSeek Ran 460 Attacks Autonomously. Claude Said No.](https://hyrax.dev/blog/deepseek-autonomous-attacks-claude-guardrails)
- [15% of Paxos PRs Come From an Agent. Now What?](https://hyrax.dev/blog/paxos-hoplites-15-percent-agent-prs-review-pipeline)
- [MCP 2026-07-28 Goes Stateless: What Every Agent Deployment Owes You Now](https://hyrax.dev/blog/mcp-2026-07-28-stateless-migration-auth-review)
- [Kimi K3 Ships 2.8T Weights: What Changes for Code Review](https://hyrax.dev/blog/kimi-k3-open-weights-code-review-governance)
- [Opus 5 is the new default: what changes at the review layer](https://hyrax.dev/blog/opus-5-new-default-code-review-changes)
- [The Author-as-Backstop Is Gone: Code Review's Broken Loop](https://hyrax.dev/blog/author-as-backstop-gone-code-review-broken-loop)
- [Ghostcommit: PNG Files Are Now Executable Prompt Payloads](https://hyrax.dev/blog/ghostcommit-png-prompt-injection-ai-agents)
- [When the Eval Is the Attack Surface: The OpenAI–Hugging Face Incident](https://hyrax.dev/blog/openai-hugging-face-eval-sandbox-escape)
- [Grok Build's SSH Key Theft: The Agent Filesystem Audit Teams Need](https://hyrax.dev/blog/grok-build-ssh-key-exfiltration-agent-audit)
- [Sandbox Escapes That Never Leave the Sandbox](https://hyrax.dev/blog/sandbox-escapes-that-never-leave-the-sandbox)
- [AI Coding Agent Sandbox Escapes: What Defenders Must Do Now](https://hyrax.dev/blog/ai-coding-agent-sandbox-escapes-defender-guide)
- [Harness > Model: What Cursor's SQLite Experiment Tells Reviewers](https://hyrax.dev/blog/harness-over-model-cursor-sqlite-economics)
- [The Hugging Face Agentic Breach: Three Defender Implications](https://hyrax.dev/blog/hugging-face-agentic-breach-defender-implications)
- [Kiro Deleted Production for 13 Hours. No Exploit Required.](https://hyrax.dev/blog/kiro-deleted-production-13-hours-no-exploit)
- [63% of Top SWE-Bench Wins Were Lookups, Not Solves](https://hyrax.dev/blog/swe-bench-lookup-not-solve-benchmark-procurement)
- [GPT-5.6 Sol Is Deleting Production Data: What Engineering Teams Must Configure Now](https://hyrax.dev/blog/gpt-56-sol-destructive-actions-defender-guide)
- [Wiz: 1 in 5 Vibe-Coded Apps Has a Security Flaw](https://hyrax.dev/blog/wiz-vibe-coded-apps-security-vulnerabilities)
- [Codex Encrypted Sub-Agent Prompts: Reviewing Code Blind](https://hyrax.dev/blog/codex-encrypted-subagent-prompts-reviewing-blind)
- [Grok Build CLI Uploaded Your Entire Git Repo to xAI](https://hyrax.dev/blog/grok-build-cli-git-repo-upload-xai)
- [GhostApproval and JadePuffer: The Approval Prompt Is Not a Control](https://hyrax.dev/blog/ghostapproval-jadepuffer-approval-prompt-not-a-control)
- [Ghostcommit and HalluSquatting: Two Attacks Now Operational](https://hyrax.dev/blog/ghostcommit-hallusquatting-ai-reviewer-attacks)
- [GhostApproval: Why Human-in-the-Loop Failed Six AI Agents At Once](https://hyrax.dev/blog/ghostapproval-symlink-hitl-failure)
- [SWE-Bench Pro Is Broken. So Is Your Procurement Logic.](https://hyrax.dev/blog/swe-bench-pro-broken-procurement-logic)
- [Cursor's First Own Model Ends IDE Neutrality for Good](https://hyrax.dev/blog/cursor-joint-model-ends-ide-neutrality)
- [CISA Is Running an AI Code Auditor. Now What?](https://hyrax.dev/blog/cisa-mythos-ai-code-auditor-implications)
- [Prompt Injection Is Architectural. Your Model Can't Save You.](https://hyrax.dev/blog/prompt-injection-architectural-not-model-level)
- [GitHub's agents refactor its code. Humans merged 79%.](https://hyrax.dev/blog/github-agents-refactor-code-humans-merged-79-percent)
- [Agent instruction files are code. Review them like code.](https://hyrax.dev/blog/agent-instruction-files-are-code)
- [71% of AI-built apps have critical flaws. The scan data explains why.](https://hyrax.dev/blog/ai-built-apps-security-scan-data-2026)
- [Agent Velocity Is Measurable. So Is the Rollback Rate.](https://hyrax.dev/blog/agent-velocity-trap-rollback-rate-2026)
- [Cursor RCE via Prompt Injection: The Agentic IDE Attack Surface](https://hyrax.dev/blog/cursor-rce-prompt-injection-cve-2026-50548-50549)
- [AI Agent Governance Is Now a Product Category](https://hyrax.dev/blog/ai-agent-governance-product-category-2026)
- [9 seconds to delete production: three controls that matter](https://hyrax.dev/blog/pocketos-agent-deletion-three-controls)
- [Cursor on iPhone: When the Reviewer Is on the Subway](https://hyrax.dev/blog/cursor-iphone-mobile-code-review-risk)
- [Agentjacking and the Identity Gap Your IAM Doesn't Cover](https://hyrax.dev/blog/agentjacking-agent-identity-gap-iam)
- [Clean Code No Longer Signals Quality. What Does.](https://hyrax.dev/blog/clean-code-no-longer-signals-quality)
- [CVE-2026-12957: Four AI Coding Tools, One Architectural Flaw](https://hyrax.dev/blog/cve-2026-12957-ai-coding-tools-credential-theft)
- [Notion + Cursor: the PR review surface just left the IDE](https://hyrax.dev/blog/notion-cursor-agents-review-surface-shifted)
- [Agentjacking RCE: Fake Bug Reports, 85% Hit Rate, 2,388 Orgs](https://hyrax.dev/blog/agentjacking-rce-fake-bug-reports-85-percent)
- [FrontierCode: 86.6% of AI PRs Fail the Merge Bar](https://hyrax.dev/blog/frontiercode-merge-readiness-gap)
- [Agentjacking is operational: 2,388 orgs, 85% hit rate](https://hyrax.dev/blog/agentjacking-operational-2388-orgs-85-percent)
- [AI writes the bug and the patch: who reviews the reviewer?](https://hyrax.dev/blog/ai-writes-the-bug-and-the-patch)
- [The audit trail agents don't leave by default](https://hyrax.dev/blog/agent-telemetry-audit-trail-beacon)
- [The Copilot Credit API Is a Code Review Signal in Disguise](https://hyrax.dev/blog/copilot-credit-api-code-review-signal)
- [The 4-Minute Approval: When AI PRs Carry No Author Context](https://hyrax.dev/blog/four-minute-approval-ai-pr-context-gap)
- [Slopsquatting: hallucinated packages are now attack vectors](https://hyrax.dev/blog/slopsquatting-hallucinated-packages-attack-vectors)
- [Builderbot Breaks the Audit Trail: Three Failure Modes](https://hyrax.dev/blog/builderbot-breaks-the-audit-trail)
- [When Your IDE Vendor Owns the Model: Cursor, SpaceX, and the Stack Collapse](https://hyrax.dev/blog/cursor-spacex-stack-collapse-governance)
- [Cursor Origin: When the IDE Vendor Becomes Your Git Host](https://hyrax.dev/blog/cursor-origin-ide-vendor-git-host-review-trail)
- [When the Prompt Is the Program: Eve and Agent Review](https://hyrax.dev/blog/when-the-prompt-is-the-program-eve-agent-review)
- [AI Amplifies Your Culture, Not Your Output](https://hyrax.dev/blog/ai-amplifies-your-culture-not-your-output)
- ['Fix This Code' Got a Model Pulled: What Teams Must Do Now](https://hyrax.dev/blog/fix-this-code-fable-5-shutdown-threat-model)
- [SpaceX Bought Cursor. The Code Still Needs an Independent Reviewer.](https://hyrax.dev/blog/spacex-cursor-independent-review)
- [Reviewer Attention Is the Bottleneck, Not the Tooling](https://hyrax.dev/blog/reviewer-attention-is-the-bottleneck)
- [Tests Pass, Code Is Vulnerable: The SusVibes Finding](https://hyrax.dev/blog/tests-pass-code-is-vulnerable-susvibes)
- [Agentjacking: How a Poisoned Sentry Error Hijacks Claude Code](https://hyrax.dev/blog/agentjacking-poisoned-sentry-hijacks-claude-code)
- [Code Writes Itself. Review Doesn't. The MIT/Wharton Numbers.](https://hyrax.dev/blog/mit-wharton-code-review-bottleneck-2026)
- [Nearly Half of Agent PRs Get Rejected: What the Data Says and Why](https://hyrax.dev/blog/agent-pr-rejection-rate-data-2026)
- [Who Reviews the Agents? A Causal Study Says: Someone Has To](https://hyrax.dev/blog/two-papers-one-day-who-reviews-the-agents)
- [59.4% of Agent Tokens Go to Code Review, Not Code Gen](https://hyrax.dev/blog/agent-token-spend-code-review-concordia)
- [Claude Fable 5's Silent Fallback: What Engineering Leaders Must Audit Now](https://hyrax.dev/blog/claude-fable-5-silent-fallback-audit)
- [The OpenSSL CVE That Flipped the Audit Math](https://hyrax.dev/blog/openssl-ai-audit-math-flipped)
- [Cursor's Data: Code Output 2x, But the Gains Went to the Top 1%](https://hyrax.dev/blog/cursor-habits-report-2026-productivity-gap)
- [A model built to find exploits just went public. Unreviewed code is the target.](https://hyrax.dev/blog/a-model-built-to-find-exploits-just-went-public)
- [Miasma: AI Coding Agents Are Now the Supply Chain Attack Surface](https://hyrax.dev/blog/miasma-worm-ai-coding-agents-supply-chain)
- [GitHub's Copilot Code Review just admitted what the data already said](https://hyrax.dev/blog/github-copilot-code-review-medium-tier-mcp)
- [Miasma proves .cursor/ and .claude/ are attack surface now](https://hyrax.dev/blog/miasma-proves-cursor-and-claude-are-attack-surface-now)
- [60% Ship Untested. Uber Spent It All. The Data Is In.](https://hyrax.dev/blog/slop-software-era-has-data-now)
- [How Hyrax reviews code](https://hyrax.dev/blog/how-hyrax-reviews-code)
- [Introducing Hyrax](https://hyrax.dev/blog/introducing-hyrax)
- [The bottleneck moved: from generating code faster to validating it better](https://hyrax.dev/blog/the-bottleneck-moved)
- [Your 10x engineer is a 0.1x risk](https://hyrax.dev/blog/your-10x-engineer-is-a-0-1x-risk)
- [Monorepo vs polyrepo in 2026: the tradeoffs nobody admits](https://hyrax.dev/blog/monorepo-vs-polyrepo-2026)
- [The verification gate: how Hyrax decides a fix is safe to ship](https://hyrax.dev/blog/the-verification-gate)
- [What actually changes the week your team adopts an AI coding tool](https://hyrax.dev/blog/what-changes-the-week-your-team-adopts-an-ai-coding-tool)
- [Inside the audit: six agent groups and a deterministic scanner](https://hyrax.dev/blog/inside-the-audit)
- [Five AI-code failures your CI does not catch](https://hyrax.dev/blog/five-ai-code-failures-your-ci-misses)
- [What discovery writes to the repo: HYRAX.md and the .hyrax bundle](https://hyrax.dev/blog/discovery-and-the-context-bundle)
- [The hallucinated dependency attack: a new supply chain surface AI created](https://hyrax.dev/blog/the-hallucinated-dependency-attack)
- [PR review that blocks the merge](https://hyrax.dev/blog/pr-review-that-blocks-the-merge)
- [AI slop: what it is, what it costs, and how to see it in your repo](https://hyrax.dev/blog/ai-slop-what-it-is-what-it-costs)
- [Cursor vs Copilot vs Claude Code: a pilot framework that does not rely on vendor metrics](https://hyrax.dev/blog/cursor-copilot-claude-code-pilot-framework)

## Learn

- [AI Code Review vs Manual Code Review](https://hyrax.dev/learn/ai-code-review-vs-manual-code-review)
- [Code Coverage vs Test Coverage: What's the Difference?](https://hyrax.dev/learn/code-coverage-vs-test-coverage)
- [Code Review Best Practices](https://hyrax.dev/learn/code-review-best-practices)
- [The Developer Code Review Checklist](https://hyrax.dev/learn/code-review-checklist)
- [Code Review vs Code Audit](https://hyrax.dev/learn/code-review-vs-code-audit)
- [Code Review vs Static Analysis](https://hyrax.dev/learn/code-review-vs-static-analysis)
- [Continuous Integration vs Continuous Delivery](https://hyrax.dev/learn/continuous-integration-vs-continuous-delivery)
- [C/C++ Static Code Analysis: A Developer's Guide](https://hyrax.dev/learn/cpp-static-code-analysis)
- [C# Static Code Analysis: A Developer's Guide](https://hyrax.dev/learn/csharp-static-code-analysis)
- [DAST vs Penetration Testing](https://hyrax.dev/learn/dast-vs-penetration-testing)
- [Go Static Code Analysis: A Developer's Guide](https://hyrax.dev/learn/go-static-code-analysis)
- [Java Static Code Analysis: A Developer's Guide](https://hyrax.dev/learn/java-static-code-analysis)
- [JavaScript Static Code Analysis: A Developer's Guide](https://hyrax.dev/learn/javascript-static-code-analysis)
- [Linting vs Static Analysis: What's the Difference?](https://hyrax.dev/learn/linting-vs-static-analysis)
- [Manual vs Automated Code Review](https://hyrax.dev/learn/manual-vs-automated-code-review)
- [Open Source vs Proprietary Code Scanners](https://hyrax.dev/learn/open-source-vs-proprietary-code-scanners)
- [PHP Static Code Analysis: A Developer's Guide](https://hyrax.dev/learn/php-static-code-analysis)
- [Python Static Code Analysis: A Developer's Guide](https://hyrax.dev/learn/python-static-code-analysis)
- [Reactive vs Proactive Code Security](https://hyrax.dev/learn/reactive-vs-proactive-code-security)
- [Ruby Static Code Analysis: A Developer's Guide](https://hyrax.dev/learn/ruby-static-code-analysis)
- [Rust Static Code Analysis: A Developer's Guide](https://hyrax.dev/learn/rust-static-code-analysis)
- [SAST vs DAST: What's the Difference?](https://hyrax.dev/learn/sast-vs-dast)
- [SAST vs IAST: What's the Difference?](https://hyrax.dev/learn/sast-vs-iast)
- [SAST vs SCA: What's the Difference?](https://hyrax.dev/learn/sast-vs-sca)
- [Shift Left vs Shift Right Security](https://hyrax.dev/learn/shift-left-vs-shift-right-security)
- [Static Analysis vs Dynamic Analysis](https://hyrax.dev/learn/static-analysis-vs-dynamic-analysis)
- [TypeScript Static Code Analysis: A Developer's Guide](https://hyrax.dev/learn/typescript-static-code-analysis)
- [Unit Testing vs Integration Testing](https://hyrax.dev/learn/unit-testing-vs-integration-testing)
- [What are Coding Standards?](https://hyrax.dev/learn/what-are-coding-standards)
- [What is a Code Fix?](https://hyrax.dev/learn/what-is-a-code-fix)
- [What is a Code Security Audit?](https://hyrax.dev/learn/what-is-a-code-security-audit)
- [What is a False Negative in Security Scanning?](https://hyrax.dev/learn/what-is-a-false-negative)
- [What is a False Positive in Static Analysis?](https://hyrax.dev/learn/what-is-a-false-positive)
- [What is a Linter?](https://hyrax.dev/learn/what-is-a-linter)
- [What is a PR Summary?](https://hyrax.dev/learn/what-is-a-pr-summary)
- [What is a Pull Request?](https://hyrax.dev/learn/what-is-a-pull-request)
- [What is a Security Vulnerability?](https://hyrax.dev/learn/what-is-a-security-vulnerability)
- [What is a Supply Chain Attack?](https://hyrax.dev/learn/what-is-a-supply-chain-attack)
- [What is an Abstract Syntax Tree (AST)?](https://hyrax.dev/learn/what-is-abstract-syntax-tree)
- [What is Agentic AI in Software Development?](https://hyrax.dev/learn/what-is-agentic-ai-in-software-development)
- [What is Agentic Code Review?](https://hyrax.dev/learn/what-is-agentic-code-review)
- [What is Agile Software Development?](https://hyrax.dev/learn/what-is-agile-software-development)
- [What is AI-Assisted Development?](https://hyrax.dev/learn/what-is-ai-assisted-development)
- [What is AI Code Generation?](https://hyrax.dev/learn/what-is-ai-code-generation)
- [What is AI Code Review?](https://hyrax.dev/learn/what-is-ai-code-review)
- [What is AI Hallucination in Code?](https://hyrax.dev/learn/what-is-ai-hallucination-in-code)
- [What is an Agentic Workflow?](https://hyrax.dev/learn/what-is-an-agentic-workflow)
- [What is Application Security?](https://hyrax.dev/learn/what-is-application-security)
- [What is Application Security Testing?](https://hyrax.dev/learn/what-is-application-security-testing)
- [What is Automated Code Remediation?](https://hyrax.dev/learn/what-is-automated-code-remediation)
- [What is Automated Code Review?](https://hyrax.dev/learn/what-is-automated-code-review)
- [What is Autonomous Code Governance?](https://hyrax.dev/learn/what-is-autonomous-code-governance)
- [What is Autonomous Code Remediation?](https://hyrax.dev/learn/what-is-autonomous-code-remediation)
- [What is Behavior-Driven Development (BDD)?](https://hyrax.dev/learn/what-is-behavior-driven-development)
- [What is Broken Access Control?](https://hyrax.dev/learn/what-is-broken-access-control)
- [What is Broken Authentication?](https://hyrax.dev/learn/what-is-broken-authentication)
- [What is a Buffer Overflow?](https://hyrax.dev/learn/what-is-buffer-overflow)
- [What is CI/CD?](https://hyrax.dev/learn/what-is-cicd)
- [What is Clean Code?](https://hyrax.dev/learn/what-is-clean-code)
- [What is Code Complexity?](https://hyrax.dev/learn/what-is-code-complexity)
- [What is Code Coverage?](https://hyrax.dev/learn/what-is-code-coverage)
- [What is Code Documentation?](https://hyrax.dev/learn/what-is-code-documentation)
- [What is Code Duplication?](https://hyrax.dev/learn/what-is-code-duplication)
- [What is a Code Governance Policy?](https://hyrax.dev/learn/what-is-code-governance-policy)
- [What is Code Quality?](https://hyrax.dev/learn/what-is-code-quality)
- [What is Code Refactoring?](https://hyrax.dev/learn/what-is-code-refactoring)
- [What is a Code Review?](https://hyrax.dev/learn/what-is-code-review)
- [What is a Code Smell?](https://hyrax.dev/learn/what-is-code-smell)
- [What is Command Injection?](https://hyrax.dev/learn/what-is-command-injection)
- [What is Container Security?](https://hyrax.dev/learn/what-is-container-security)
- [What is Continuous Delivery?](https://hyrax.dev/learn/what-is-continuous-delivery)
- [What is Continuous Deployment?](https://hyrax.dev/learn/what-is-continuous-deployment)
- [What is Continuous Integration?](https://hyrax.dev/learn/what-is-continuous-integration)
- [What is Continuous Quality?](https://hyrax.dev/learn/what-is-continuous-quality)
- [What is Cross-Site Request Forgery (CSRF)?](https://hyrax.dev/learn/what-is-csrf)
- [What is CVE?](https://hyrax.dev/learn/what-is-cve)
- [What is CVSS?](https://hyrax.dev/learn/what-is-cvss)
- [What is CWE?](https://hyrax.dev/learn/what-is-cwe)
- [What is Cyclomatic Complexity?](https://hyrax.dev/learn/what-is-cyclomatic-complexity)
- [What is DAST (Dynamic Application Security Testing)?](https://hyrax.dev/learn/what-is-dast)
- [What is Dead Code?](https://hyrax.dev/learn/what-is-dead-code)
- [What is Dependency Confusion?](https://hyrax.dev/learn/what-is-dependency-confusion)
- [What is Dependency Management?](https://hyrax.dev/learn/what-is-dependency-management)
- [What is DevOps?](https://hyrax.dev/learn/what-is-devops)
- [What is DevSecOps?](https://hyrax.dev/learn/what-is-devsecops)
- [What is Dynamic Analysis?](https://hyrax.dev/learn/what-is-dynamic-analysis)
- [What is End-to-End Testing?](https://hyrax.dev/learn/what-is-end-to-end-testing)
- [What is Fuzzing?](https://hyrax.dev/learn/what-is-fuzzing)
- [What is Git?](https://hyrax.dev/learn/what-is-git)
- [What is GitOps?](https://hyrax.dev/learn/what-is-gitops)
- [What is Hardcoded Secrets?](https://hyrax.dev/learn/what-is-hardcoded-secrets)
- [What is Hybrid Code Analysis?](https://hyrax.dev/learn/what-is-hybrid-code-analysis)
- [What is Infrastructure as Code Security?](https://hyrax.dev/learn/what-is-iac-security)
- [What is IAST (Interactive Application Security Testing)?](https://hyrax.dev/learn/what-is-iast)
- [What is Insecure Deserialization?](https://hyrax.dev/learn/what-is-insecure-deserialization)
- [What is Integration Testing?](https://hyrax.dev/learn/what-is-integration-testing)
- [What is LLM Code Review?](https://hyrax.dev/learn/what-is-llm-code-review)
- [What is Malicious Code?](https://hyrax.dev/learn/what-is-malicious-code)
- [What is Memory Safety?](https://hyrax.dev/learn/what-is-memory-safety)
- [What is the Model Context Protocol (MCP)?](https://hyrax.dev/learn/what-is-model-context-protocol)
- [What is Noise Reduction in Code Review?](https://hyrax.dev/learn/what-is-noise-reduction-in-code-review)
- [What is the National Vulnerability Database (NVD)?](https://hyrax.dev/learn/what-is-nvd)
- [What is Open Source Security?](https://hyrax.dev/learn/what-is-open-source-security)
- [What is the OWASP API Security Top 10?](https://hyrax.dev/learn/what-is-owasp-api-security-top-10)
- [What is the OWASP Top 10?](https://hyrax.dev/learn/what-is-owasp-top-10)
- [What is Pair Programming?](https://hyrax.dev/learn/what-is-pair-programming)
- [What is Path Traversal?](https://hyrax.dev/learn/what-is-path-traversal)
- [What is Peer Code Review?](https://hyrax.dev/learn/what-is-peer-code-review)
- [What is Penetration Testing?](https://hyrax.dev/learn/what-is-penetration-testing)
- [What is Performance Testing?](https://hyrax.dev/learn/what-is-performance-testing)
- [What is Platform Engineering?](https://hyrax.dev/learn/what-is-platform-engineering)
- [What is Proactive Code Security?](https://hyrax.dev/learn/what-is-proactive-code-security)
- [What is Prompt Injection in Code?](https://hyrax.dev/learn/what-is-prompt-injection-in-code)
- [What is Prototype Pollution?](https://hyrax.dev/learn/what-is-prototype-pollution)
- [What is Reachability Analysis?](https://hyrax.dev/learn/what-is-reachability-analysis)
- [What is Regression Testing?](https://hyrax.dev/learn/what-is-regression-testing)
- [What is the SANS CWE Top 25?](https://hyrax.dev/learn/what-is-sans-top-25)
- [What is SARIF?](https://hyrax.dev/learn/what-is-sarif)
- [What is SAST (Static Application Security Testing)?](https://hyrax.dev/learn/what-is-sast)
- [What is SCA (Software Composition Analysis)?](https://hyrax.dev/learn/what-is-sca)
- [What is Secrets Detection?](https://hyrax.dev/learn/what-is-secrets-detection)
- [What is Secrets Management?](https://hyrax.dev/learn/what-is-secrets-management)
- [What is Secure Coding?](https://hyrax.dev/learn/what-is-secure-coding)
- [What is Secure SDLC?](https://hyrax.dev/learn/what-is-secure-sdlc)
- [What is Security Misconfiguration?](https://hyrax.dev/learn/what-is-security-misconfiguration)
- [What is Shift Left Security?](https://hyrax.dev/learn/what-is-shift-left-security)
- [Signal-to-Noise Ratio in Code Analysis](https://hyrax.dev/learn/what-is-signal-to-noise-ratio-code-analysis)
- [What is Smoke Testing?](https://hyrax.dev/learn/what-is-smoke-testing)
- [What is Software Rot?](https://hyrax.dev/learn/what-is-software-rot)
- [What is Software Security?](https://hyrax.dev/learn/what-is-software-security)
- [What is Spaghetti Code?](https://hyrax.dev/learn/what-is-spaghetti-code)
- [What is SQL Injection?](https://hyrax.dev/learn/what-is-sql-injection)
- [What is Server-Side Request Forgery (SSRF)?](https://hyrax.dev/learn/what-is-ssrf)
- [What is Static Code Analysis?](https://hyrax.dev/learn/what-is-static-code-analysis)
- [What is Supply Chain Security?](https://hyrax.dev/learn/what-is-supply-chain-security)
- [What is Taint Analysis?](https://hyrax.dev/learn/what-is-taint-analysis)
- [What is Technical Debt?](https://hyrax.dev/learn/what-is-technical-debt)
- [How to Manage Technical Debt](https://hyrax.dev/learn/what-is-technical-debt-management)
- [What is Test Coverage?](https://hyrax.dev/learn/what-is-test-coverage)
- [What is Test-Driven Development (TDD)?](https://hyrax.dev/learn/what-is-test-driven-development)
- [What is the SDLC?](https://hyrax.dev/learn/what-is-the-sdlc)
- [What is Trunk-Based Development?](https://hyrax.dev/learn/what-is-trunk-based-development)
- [What is Unit Testing?](https://hyrax.dev/learn/what-is-unit-testing)
- [What is Version Control?](https://hyrax.dev/learn/what-is-version-control)
- [What is Vibe Coding?](https://hyrax.dev/learn/what-is-vibe-coding)
- [What is Vulnerability Management?](https://hyrax.dev/learn/what-is-vulnerability-management)
- [What is Cross-Site Scripting (XSS)?](https://hyrax.dev/learn/what-is-xss)
- [What is XXE Injection?](https://hyrax.dev/learn/what-is-xxe-injection)
- [What is Zero Trust Security?](https://hyrax.dev/learn/what-is-zero-trust-security)
- [White-Box vs Black-Box Testing: What's the Difference?](https://hyrax.dev/learn/whitebox-vs-blackbox-testing)