Same Count, Different Bugs: Build LLM Security Scans as an Evidence Funnel
TL;DR for operators Two runs of an LLM security scanner can return almost the same number of findings while disagreeing substantially about which code locations are vulnerable. That makes finding count a weak reproducibility metric and a risky basis for remediation decisions. Bugstone-E2E, introduced in The History Is the Detector: Executing CVE Patch History, End-to-End,1 offers a broader operating model. It turns verified CVE fixing commits into reusable detection skills, uses deterministic machinery to shrink the search space before asking an LLM for semantic judgments, and sends stronger claims through separate runtime validation. ...