A team runs an automated red-team attack on their codebase every night from 2 AM to 5 AM using an open-source language model to find vulnerabilities and bugs. They argue this catches real security problems that compliance certifications like SOC 2 miss, and the off-hours spot compute makes it nearly free.
Chapters
the company to sort of prevent like cybersecurity attacks. So I think like some of the compliance stuff, we still need to get it just because like we sell to different enterprises and they ask for compliance. But some of that stuff just like seems pointless to us inherently. Like having like SOC 2 compliance or like SOC or like ISO, whatever, et cetera, doesn't really mean anything if you can just have like an agent find vulnerabilities in your codebase. And it's not just us, it's like every other sort of company that exists. So what we started doing is like every time someone pushes a PR, through the, the code base and they change the actual code at night, every night at 2:00 AM. A PR being a product release. Yeah, exactly. Just a new, new feature or something that goes in every night from 2:00 AM to 5:00 AM. We just— pull request. Pull request. Yeah. Pull request. Yeah. We, we essentially launch like, uh, it's Kimi K3 right now, but it's whatever open source frontier model that doesn't require like security checks to actually like do it. And we ask it to hack into the code base and try to figure out vulnerabilities in the, the code. And it's essentially free because we're running it on like off hours. So we can use like very cheap spot compute. We also sell compute, so it's easier now, but like we run on very cheap like spot compute at that time. And it finds all these different issues, not just with like the security parts, but anything in the code base. So we figured out that that's like probably the best way to solve a lot of these security issues while there's a bunch of like probably things that can happen and go wrong.
