Writing
Selected writing on code intelligence, static analysis, coding agents, and earlier program-analysis research.
I write about Bifrost, the SlopCop online scanner, and the practical work of building and evaluating static analysis. Most of my current posts appear on the SlopCop blog, which is still hosted at blog.brokk.ai. This page is a curated index rather than a separate personal blog.
Recent writing at SlopCop
-
Following untrusted data through a database
Modeling storage boundaries in Bifrost so taint analysis can connect writes to later reads, with explicit API identity, key matching, and analysis limits.
-
What is the best static analysis tool for your use case?
Using DataFlowBench to compare analyzer trade-offs for CI, editor and agent loops, security review, and workflows where false positives matter most.
-
The Taint Analysis Power Ranking
How frozen positive and negative cases compare eight analyzers, keeping precision, recall, language coverage, responsiveness, and incomplete results distinct.
-
Why we switched SlopCop to Flash 3.5
A benchmark-driven look at model cost, speed, stability, tool use, and report quality in a multi-agent code-review system.
-
SlopCop: Forensics for your codebase
How static-analysis signals and specialist agents can turn maintainability findings into evidence-backed remediation work.
-
Building a JavaScript Reference Graph With an Agent
Lessons from using an agent, domain expertise, adversarial tests, and iterative review to build production reference analysis.
-
Stop Allocating Nothing: How We Tripled Java TreeSitter Performance
Tracing unnecessary JNI allocations and garbage-collection pressure to a small null-node handling path.
See all posts on the SlopCop blog or subscribe to its RSS feed.
Earlier writing
Learning Type Inference for Enhanced Dataflow Analysis
A practical introduction to the CodeTIDAL5 and JoernTI work behind our 2023 ESORICS paper, connecting learned type inference to more precise data-flow analysis.
My older Medium archive documents an earlier period of work focused heavily on code property graphs and graph-database backends. I keep it available as historical context rather than a statement of my current focus.