From the workbench.

Notes on analysis, safe fixes, and keeping codebases true: from the people building the engine.

2026-09-11
AI Code Security

What TrueMend Deliberately Can't Do

Six in January, fifteen in February, thirty-five in March, CVEs traced to AI-generated code. Here's the honest version of where a static analyzer stops.

→
2026-09-08
Product Honesty

Read The License Before The Vendor Changes It On You

2026 has been a rough year for trusting a tool's open-source label at face value. Here's exactly what's Apache 2.0 in TrueMend, what isn't, and why we drew the line where we did.

→
2026-09-02
Product Honesty

A Written Log Is Not Memory

We could have claimed TrueMend learns your codebase over time. We wrote a document instead that says exactly why it doesn't, and what's true instead.

→
2026-08-22
Detection Quality

The Benchmark That Argues With Itself

Most tools publish the number that makes them look good. We published the one where Bash loses to ShellCheck.

→
2026-08-19
Technical Debt

AI Doesn't Fix Your Technical Debt Problem, It Amplifies It

SIG's State of Software 2026 report put a number on something we'd already built pricing for: debt and security move together, and most AI-generated code is landing on top of an unmeasured foundation.

→
2026-08-14
AI Code Security

The 56% Problem

Models keep getting smarter. The industry's security pass rate hasn't moved. Here's what we actually found when we routed around it instead of waiting on it.

→
2026-08-05
Detection Quality

Nine Out of Ten Alerts Are Wrong, and Everyone Knows It

The security industry's own 2026 numbers say most SAST output trains developers to ignore the tool. We published our own noise rate instead of hiding behind the word 'AI-powered.'

→
2026-07-24
AI Code Security

The Bottleneck Moved, and Most Teams Haven't Noticed

Writing code stopped being the slow part years ago. In 2026 the data finally caught up: review is where the pipeline actually backs up now.

→
2026-07-22
engineering

81 detections we were silently throwing away

The line-scan engine treated # and // as comment markers in every language, truncating URLs in Bash and private fields in TypeScript. Language-aware stripping recovered 81 real findings across 2,915 files, with zero new false positives.

→
2026-07-18
announcement

TrueMend is on PyPI, and it is open-core

pip install truemend. Every AST analysis, every detection spec, the deterministic fixes, the MCP server and SARIF/CI integration are free forever. Pro and Max buy reporting and judgment, not detection.

→
2026-03-25
announcement

Introducing Truemend: deterministic code quality at scale

At launch: 5,449 anti-patterns across 144 specs. 22 languages. Three-tier remediation. AST-level pattern matching gives us the precision of a compiler with the breadth of a linter. Meet the engine.

→
2026-03-20
methodology

Why three tiers? The science behind safe code remediation

Every code quality tool finds issues. The hard part is fixing them without breaking things.

→
2026-03-18
architecture

MCP-native: why zero infrastructure matters

SonarQube needs a server. CodeClimate needs a cloud. Truemend runs as an MCP server over stdio, inside your editor: zero latency, zero configuration, zero data exposure.

→

more from the workbench soon · rss available