Notes from the workbench, including the parts that went wrong.

Notes on analysis, mechanical fixes, and keeping codebases true: from the people building the engine.

2026-09-11

What Truemend Deliberately Can't Do

Six in January, fifteen in February, thirty-five in March, CVEs traced to AI-generated code. Here's where a static analyzer stops.

→

2026-09-08

Product accuracy

Read The License Before The Vendor Changes It On You

2026 has been a rough year for trusting a tool's open-source label at face value. Here's exactly what's Apache 2.0 in Truemend, what isn't, and why we drew the line where we did.

→

2026-09-02

Product accuracy

A Written Log Is Not Memory

We could have claimed Truemend learns your codebase over time. We wrote a document instead that says exactly why it doesn't, and what's true instead.

→

2026-08-22

Detection Quality

The Benchmark That Argues With Itself

Most tools publish the number that makes them look good. We published the one where Bash loses to ShellCheck.

→

2026-08-19

Technical Debt

AI Doesn't Fix Your Technical Debt Problem, It Amplifies It

SIG's State of Software 2026 report put a number on something we'd already built pricing for: debt and security move together, and most AI-generated code is landing on top of an unmeasured foundation.

→

2026-08-14

AI Code Security

The 56% Problem

Models keep getting smarter. The industry's security pass rate hasn't moved. Here's what we found when we routed around it instead of waiting on it.

→

2026-08-05

Detection Quality

Nine Out of Ten Alerts Are Wrong, and Everyone Knows It

The security industry's own 2026 numbers say most SAST output trains developers to ignore the tool. We published our own noise rate instead of hiding behind the word 'AI-powered.'

→

2026-07-24

AI Code Security

The Bottleneck Moved, and Most Teams Haven't Noticed

Writing code stopped being the slow part years ago. In 2026 the data finally caught up: review is where the pipeline backs up now.

→

2026-07-18

announcement

Truemend is on PyPI, and it is open-core

pip install truemend. Every AST analysis, every detection spec, the deterministic fixes, the MCP server and SARIF/CI integration are free forever. Pro and Max buy reporting and judgment, not detection.

→

2026-03-25

announcement

Introducing Truemend: deterministic code quality at scale

At launch: 5,449 anti-patterns across 144 specs. 22 languages. Three-tier remediation. AST-level pattern matching gives us the precision of a compiler with the breadth of a linter. Meet the engine.

→

2026-03-20

methodology

Why three tiers? How the three remediation tiers work

Every code quality tool finds issues. The hard part is fixing them in a way you can check.

→

2026-03-18

architecture

MCP-native: why zero infrastructure matters

SonarQube needs a server. CodeClimate needs a cloud. Truemend runs as an MCP server over stdio, inside your editor: no server to run, no configuration, and no cloud service in the analysis path.

→