Software Bug Hunter (SBH) · Invariant Security Scanner
The high-assurance, language-agnostic security engine engineered to solve the False Positive Crisis in static application security testing (SAST). Powered by Abstract Syntax Tree (AST) Invariant Verification, Geometric Curvature Analysis, and Substrate Discrepancy Theorems pioneered by Shrikant Bhosale.
pip install sbh-scanner
AST Invariant Slayer
Eliminates the 40%+ false positive rate of standard scanners. Traverses abstract syntax trees to prove constant propagation, schema normalization, and taint sanitizers before alerting.
Geometric Curvature (κ)
Replaces arbitrary CVSS numbers with mathematically rigorous manifold curvature ($0.000 – 1.000$) computing the exact exploitability tensor across memory, injection, and logic boundaries.
Zero-Config SARIF CI/CD
Full compliance with OASIS SARIF v2.1.0 standard. Instantly streams findings directly into GitHub Code Scanning alerts, GitLab Security Dashboards, and VS Code.
Live Invariant Engine Demo
Select a code sample or input custom Python code to observe how SBH evaluates syntactic candidates against AST Invariant proofs.
Comparison: The False Positive Dilemma
Why leading enterprises and security teams suffer from alert fatigue, and how SBH solves it at the structural layer.
| Capability / Metric | SonarQube & Snyk | Semgrep & Bandit | SBH (Software Bug Hunter) |
|---|---|---|---|
| False Positive Rate | 35% – 55% (High alert fatigue) | 25% – 40% (Rule dependent) | < 3% (Near-Zero with Invariant Layer) |
| Verification Engine | Heuristic syntactic regex | Pattern matching AST queries | Universal AST + Cognitive Invariant Proofs |
| Constant String Immutability | Frequently flagged (e.g. static os.system) | Requires manual ignore comments | Automatically proven safe via AST literal check |
| Sanitizer Tracing | Shallow or premium-tier only | Manual rule customization needed | Automatic backward taint tracing (shlex, casts) |
| Exploitability Metric | Subjective CVSS scoring | Static severity tags (Info/Warn/Error) | GVF Curvature Tensor (κ: 0.000 to 1.000) |
| Non-Linear Bug Clustering | None (Linear list) | None (Linear list) | TAC Relaxation (Simulated Annealing Particles) |
| SARIF v2.1.0 Export | Complex enterprise configuration | Supported with CLI flags | Native 1-flag zero-config SARIF output |
| Licensing & Agility | Expensive proprietary tiers | Freemium / Open source core | Open Source MIT (Shrikant Bhosale) |
Birth of Vulnerabilities
In Birth of Vulnerabilities, Shrikant Bhosale demonstrates that bugs are not random accidents; they arise when cognitive models of trust diverge from operational invariants. SBH’s AST engine implements Chapter 2’s Schema Normalization and Zero-Fragility Trust Boundaries to mathematically verify whether input parameters can violate memory or control invariants.
Read the Monograph →Turing Incomplete
In Turing Incomplete, the formal limits of theoretical machines are reconciled with finite silicon substrates. SBH’s binary and memory corruption checkers incorporate Chapter 1’s Substrate Bound Invariants, calculating how finite stack frames, register boundaries, and memory layouts constrain execution paths.
Explore the Monograph →Continuous Security Automation (CI/CD)
Add SBH to your GitHub Actions workflow in 3 lines of YAML and view verified alerts in your repository’s Security tab.
# .github/workflows/sbh_security.yml
name: SBH Invariant Security Scan
on: [push, pull_request]
jobs:
security-audit:
runs-on: ubuntu-latest
permissions:
security-events: write
contents: read
steps:
- uses: actions/checkout@v4
- name: Run SBH Invariant Scanner
uses: ishrikantbhosale/SBH@v1
with:
target: '.'
sarif: 'sbh-findings.sarif'
fail-on-critical: 'true'
- name: Upload SARIF to GitHub Code Scanning
uses: github/codeql-action/upload-sarif@v3
if: always()
with:
sarif_file: 'sbh-findings.sarif'