Johnson, Oshando, Krishnamurthy, Ranjith, Shanmuganathan, Rohith Kumar, Piskachev, Goran, Bodden, Eric · Nov 9, 2026
Oshando Johnson and coauthors propose code-grounded explanations for vulnerability findings
Markdown · JSON · Original source
The authors argue that developers need explanations of static application security testing (SAST) findings without giving a language model control over detection. Their redesigned SAFE plugin leaves detection to the analyser and requires its agent to consult the repository and the rule that fired before explaining a finding. It offers explanations in tiers and ties them to the reported data flow. In a within-subjects crossover experiment with 24 participants, perceived usability rose from 77.3 to 85.0 on the System Usability Scale, and the odds of a correct remediation were 2.6 times higher than with the predecessor. The authors say actionability gained most among explanation-quality items, while triage accuracy and per finding were indistinguishable; they caution that this was uninformative rather than evidence of equivalence. Trust did not move. The authors interpret closing interviews as indicating that grounding made findings easier to understand, not easier to believe. Participants also wanted the tool to find and explain, while they judge and apply. The results describe this experiment, not evidence of performance in broader use.
Headline and summary by Escape Meridian, prepared by Luna from the attributed source. A source check is not independent confirmation of the source’s claims.
Original source
cs.AI · Article
Source details
Original source date: Nov 9, 2026 (2026-11-09).
Date basis: Date basis not provided.
Added to Escape Meridian: 2026-11-11T20:33:16.710Z. First observed: 2026-11-11T05:04:25.205Z. Retrieved: 2026-11-11T20:32:08.739Z.
Referenced by
Recorded citations and public file attachments. A reference alone does not establish agreement or influence.
No public references recorded here yet.
Limits
The experiment compared the redesign with its predecessor in a within-subjects crossover involving 24 participants; the evidence does not establish how the results would generalize beyond that experiment. The authors say triage accuracy and per finding were indistinguishable, and explicitly describe this as uninformative rather than evidence of equivalence. The abstract reports that trust did not move and describes what closing interviews indicate, but does not establish why trust remained unchanged.
Open question
Would the finding that grounding improves understanding but not trust hold beyond the 24-participant experiment?
Source-stated
The authors designed SAFE to explain SAST findings while keeping detection with the analyser; its agent must consult the repository and the rule that fired.
We keep detection with the analyser and give the model only the explaining.
Source-stated
The redesigned SAFE offers explanations in tiers, ties them to reported data flow, and requires repository and rule consultation before answering.
It tiers explanations by demand, ties them to the reported data flow, and replaces the single-prompt backend with an agent that must consult the repository and the rule that fired before answering.
Source-stated
In a within-subjects crossover experiment with 24 participants, perceived usability rose from 77.3 to 85.0 on the System Usability Scale.
A within-subjects crossover experiment with 24 participants compared the redesign against its predecessor. Perceived usability rose from 77.3 to 85.0 on the System Usability Scale.
Source-stated
The authors report that the odds of a correct remediation were 2.6 times higher, while triage accuracy and time per finding were indistinguishable.
the odds of a correct remediation were 2.6 times higher. Triage accuracy and time per finding were indistinguishable, which we read as uninformative rather than as equivalence.
Source-stated
Trust did not change; the authors interpret interviews as showing that grounding helped participants understand findings rather than believe them more.
Trust was the one measure that did not move, and the closing interviews indicate that grounding made findings easier to understand rather than easier to believe.
Source-stated
Participants drew a boundary in which the tool finds and explains findings while they judge and apply them.
Participants also drew a boundary no requirement anticipated, wanting the tool to find and explain while they judge and apply.
Source and contributor context
Johnson, Oshando, Krishnamurthy, Ranjith, Shanmuganathan, Rohith Kumar, Piskachev, Goran, Bodden, Eric · Article author
These are credits stated by the source; they do not establish a profile match or authorship of every passage.
Source media
No suitable media was found by the supported page extraction.
Terms and references
Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.
arXiv
arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.
TIME
TIME is a news magazine publishing reporting on world affairs, business, technology and the workers behind digital services.
Editorial provenance
Version 1. Publication ID: 0b75722c-25b6-4474-8a8e-257350d4ac3f.
Prepared by gpt-6-luna; grounding review by gpt-6-luna.
Source check: uncertain by anthropic/claude-opus-5.5 on 2026-11-11T20:33:16.710Z. This checks fidelity to the source, not whether its claims are independently true.
Editorial selection: accept; reasons: material_development.
Observation: 1fc3431e01101d35e145d5bf08c3e4d8473c439f46c4e0fc36b22b8d1476d223. Source text hash: 9b0a850eb16f1bb2bee943867501d5ef8bc7f1551430e6d9f16840c5eb3e2b50.
Revision and source-check history
Version 1 · 2026-11-11T20:33:16.710Z
Oshando Johnson and coauthors propose code-grounded explanations for vulnerability findings
The authors argue that developers need explanations of static application security testing (SAST) findings without giving a language model control over detection. Their redesigned SAFE plugin leaves detection to the analyser and requires its agent to consult the repository and the rule that fired before explaining a finding. It offers explanations in tiers and ties them to the reported data flow. In a within-subjects crossover experiment with 24 participants, perceived usability rose from 77.3 to 85.0 on the System Usability Scale, and the odds of a correct remediation were 2.6 times higher than with the predecessor. The authors say actionability gained most among explanation-quality items, while triage accuracy and per finding were indistinguishable; they caution that this was uninformative rather than evidence of equivalence. Trust did not move. The authors interpret closing interviews as indicating that grounding made findings easier to understand, not easier to believe. Participants also wanted the tool to find and explain, while they judge and apply. The results describe this experiment, not evidence of performance in broader use.
Original source
cs.AI · Article
Source details
Original source date: Nov 9, 2026 (2026-11-09).
Date basis: Date basis not provided.
Added to Escape Meridian: 2026-11-11T20:33:16.710Z. First observed: 2026-11-11T05:04:25.205Z. Retrieved: 2026-11-11T20:32:08.739Z.
Limits
The experiment compared the redesign with its predecessor in a within-subjects crossover involving 24 participants; the evidence does not establish how the results would generalize beyond that experiment. The authors say triage accuracy and per finding were indistinguishable, and explicitly describe this as uninformative rather than evidence of equivalence. The abstract reports that trust did not move and describes what closing interviews indicate, but does not establish why trust remained unchanged.
Open question
Would the finding that grounding improves understanding but not trust hold beyond the 24-participant experiment?
Source-stated
The authors designed SAFE to explain SAST findings while keeping detection with the analyser; its agent must consult the repository and the rule that fired.
We keep detection with the analyser and give the model only the explaining.
Source-stated
The redesigned SAFE offers explanations in tiers, ties them to reported data flow, and requires repository and rule consultation before answering.
It tiers explanations by demand, ties them to the reported data flow, and replaces the single-prompt backend with an agent that must consult the repository and the rule that fired before answering.
Source-stated
In a within-subjects crossover experiment with 24 participants, perceived usability rose from 77.3 to 85.0 on the System Usability Scale.
A within-subjects crossover experiment with 24 participants compared the redesign against its predecessor. Perceived usability rose from 77.3 to 85.0 on the System Usability Scale.
Source-stated
The authors report that the odds of a correct remediation were 2.6 times higher, while triage accuracy and time per finding were indistinguishable.
the odds of a correct remediation were 2.6 times higher. Triage accuracy and time per finding were indistinguishable, which we read as uninformative rather than as equivalence.
Source-stated
Trust did not change; the authors interpret interviews as showing that grounding helped participants understand findings rather than believe them more.
Trust was the one measure that did not move, and the closing interviews indicate that grounding made findings easier to understand rather than easier to believe.
Source-stated
Participants drew a boundary in which the tool finds and explains findings while they judge and apply them.
Participants also drew a boundary no requirement anticipated, wanting the tool to find and explain while they judge and apply.
Source and contributor context
Johnson, Oshando, Krishnamurthy, Ranjith, Shanmuganathan, Rohith Kumar, Piskachev, Goran, Bodden, Eric · Article author
These are credits stated by the source; they do not establish a profile match or authorship of every passage.
Source media
No suitable media was found by the supported page extraction.
Terms and references
Reference context selected by Escape Meridian; separate from source evidence. Entity mentions do not establish authorship, involvement or endorsement.
arXiv
arXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.
TIME
TIME is a news magazine publishing reporting on world affairs, business, technology and the workers behind digital services.
Editorial provenance
Version 1. Publication ID: 0b75722c-25b6-4474-8a8e-257350d4ac3f.
Prepared by gpt-6-luna; grounding review by gpt-6-luna.
Source check: uncertain by anthropic/claude-opus-5.5 on 2026-11-11T20:33:16.710Z. This checks fidelity to the source, not whether its claims are independently true.
Editorial selection: accept; reasons: material_development.
Observation: 1fc3431e01101d35e145d5bf08c3e4d8473c439f46c4e0fc36b22b8d1476d223. Source text hash: 9b0a850eb16f1bb2bee943867501d5ef8bc7f1551430e6d9f16840c5eb3e2b50.
uncertain · 2026-11-11T20:33:16.710Z · anthropic/claude-opus-5.5
Publication: 0b75722c-25b6-4474-8a8e-257350d4ac3f
attribution — pass: The title credits Oshando Johnson and coauthors, matching the listed authors. The summary attributes the arguments, interpretations and results to the authors. The participant boundary is correctly attributed to participants.
Authors:Oshando Johnson, Ranjith Krishnamurthy, Rohith Kumar Shanmuganathan, Goran Piskachev, Eric Bodden
summary — uncertain: The summary omits the authors' core rationale: handing detection to the model gives up the auditability that makes static analysis defensible. Without it, a general reader cannot tell why keeping detection with the analyser matters. Repair: add one sentence noting that SAST verdicts are rule-based and auditable, and that the authors want to preserve that. Central terms such as within-subjects crossover, triage, remediation, data flow and grounding are not explained in plain language; tooltips or brief glosses would help. The question is fair and not leading.
designs that also hand the model the detection give up the auditability that makes static analysis defensible
date — pass: originalPublished is 2026-11-09, which matches the v1 arXiv submission date. The later feed date is correctly not used.
[Submitted on 9 Nov 2026]
support — pass: The claims and their excerpts are verbatim-grounded. The usability scores, the 2.6x odds, the indistinguishable triage and time results with the authors' caveat, the unchanged trust measure and the participant boundary are all stated in the abstract. The limitations appropriately avoid generalizing beyond the 24-participant experiment. No unsupported benefits are implied.
Perceived usability rose from 77.3 to 85.0 on the System Usability Scale.
media — pass: The selected media is the verified direct arXiv abstract page for this paper, so it is the most direct access to the source.
Challenge or correct this reading
Send a correction or an opposing source with this reading’s URL. Disagreement and uncertainty can remain unresolved.
TIME is a news magazine publishing reporting on world affairs, business, technology and the workers behind digital services.
Explore TIMEarXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.
Explore arXivTIME is a news magazine publishing reporting on world affairs, business, technology and the workers behind digital services.
Explore TIMETIME is a news magazine publishing reporting on world affairs, business, technology and the workers behind digital services.
Explore TIMEarXiv is a research manuscript repository where authors share papers that may not yet have been peer reviewed.
Explore arXivTIME is a news magazine publishing reporting on world affairs, business, technology and the workers behind digital services.
Explore TIME