The previous post covered how we structured the codebase: Effect conventions, ast-grep enforcement, Drift, and CLAUDE.md to collaborate with Claude Code. You describe what you want, review the output, iterate. That works well. This post is about what happens when you step away entirely: giving the agent a list of issues and letting it work through them while you do something else. In autonomous mode, there's no... - Source: dev.to / 3 months ago

We use ast-grep as a structural syntax scanner that operates on the syntax tree of code (using tree-sitter under the hood). You define patterns in a YAML file, and it matches those patterns against the codebase. Critically, it’s run as part of the CI pipeline and configured to exit with an error when a banned pattern is found. And they have to be errors, not warnings. We learned this the hard way. Warnings get... - Source: dev.to / 4 months ago

I linked this elsewhere but, the agent could have a skill to use https://ast-grep.github.io/ to perform such mechanical code changes. - Source: Hacker News / 4 months ago

The proper tool for this is ast-grep (sg) https://ast-grep.github.io/ And an agent can learn to use sg with a skill too. (Or they can use sed) The issue is, at every point you do a replace, you need to verify if it was the right thing to do or if it was a false positive. If you are doing this manually, there's the time to craft the sed or sg query, then for each replacement you need to check it. If there are... - Source: Hacker News / 4 months ago

We use https://ast-grep.github.io (on a pre-commit hook). Bridges the linter gaps nicely. - Source: Hacker News / 5 months ago

Secureframe | Remote (Canada) | https://secureframe.com | 150-200k CAD Secureframe helps company get compliant and build trust with their customers. We do this by integrating in a companies core SaaS tools, ingesting data, and then displaying all misconfigurations that need to be remediated for a given security framework. Stack is Rails/React/Typescript/Postgres/Elasticsearch We've got three open engineering roles... - Source: Hacker News / over 1 year ago

My org is in a position where we'll need to get SOC II or ISO 27001 certified in the next year. I've been doing some research on the easiest way to go about this, and discovered secureframe (https://secureframe.com/). It looks like it is a platform that helps you automate/track some of the compliance tasks, but doesn't actually do the audit (they have partners that work through the platform). I'm wondering if... Source: over 3 years ago

Hi, founder of Secureframe (https://secureframe.com) here. Secureframe helps streamline compliance across SOC 2, ISO 27001, HIPAA, PCI DSS, and more. There are so many accurate responses in this thread. Like many have mentioned, SOC 2 is indeed not a prescriptive framework. Much of the confusion behind SOC 2 stems from that fact. It allows you to customize your InfoSec program to your company's needs. As we know,... - Source: Hacker News / over 4 years ago