There is one model in the product, and this page is where it sits.
If your security review asks where a model touches your code, the answer is here and nowhere else. Sentences about a finding’s history are written by code, from run history that never leaves your machine. A small local model may reword one of those sentences, and it may not change what the sentence says.
Rewording is optional, runs on your own hardware, and is off unless you turn it on.
The claim is settled before any model sees it.
“This finding first appeared 4 months ago and is still open.”
Your run history stays on your machine. It is read locally and the sentence is composed from it. If you switch rewording on, that finished sentence is the only thing the model receives, and one sentence is the only thing it may hand back.
Three things it cannot do, and how that is checked.
A guarantee nobody tests is a promise. This one is measured by replaying rewrites built to break it.
It is never given a number, a count, or a finding. There is nothing in front of it to get wrong.
A version that would say something stronger, weaker, or other than the sentence written for the record is discarded, and the original ships.
The model runs on your own hardware. An address that is not local warns you, because it would mean text leaving the host.
Twenty rewrites that alter the claim in the ways a model plausibly would were replayed against the guarantee: reversing subject and object, hardening a bounded count, adding a cause that was never stated. All twenty were rejected. Eight faithful rewrites were accepted.
One of the twenty is real. During a benchmark a model turned a sentence about a finding into a sentence about the runs: same words, same number, nothing dropped, and the claim reversed.
Some disk, and nothing else.
No account, no API key, and no service for it to reach.
The model weights, downloaded once. About 20 MB for the local server.
Output is byte-identical for anyone who never enables it.
A GPU is roughly six times faster at identical output. Speed only, not better wording.
Nothing leaves the machine. There is no service to sign up for.
Worth saying plainly, since the word model does a lot of work.
Findings come from deterministic analysis of your code. No model is involved in deciding what is wrong.
Corrections are deterministic transforms on the syntax tree. This touches one thing: the wording of a history sentence.
It does not read your findings and tell you about them. It receives one finished sentence and returns one sentence.