CodeRabbit 投入 100 万美元为开源项目免费提供 Deep Scan 安全扫描
开源项目常被自动化工具挖洞，维护者却只能下班后修。CodeRabbit 这次拿出 100 万美元给 1,125 个仓库免费做渗透级扫描，已找出 1,215 个高危问题并修复 75 个。自己维护开源库的人可以去申请，做安全工具的团队也该看看它的扫描思路。
CodeRabbit 宣布投入 100 万美元，向开源维护者免费提供 Deep Scan 漏洞扫描服务。首批扫描已在 1,125 个公开仓库中发现 1,215 个高危或严重级别的漏洞，其中 75 个已被修复，全部不对项目方收取费用。这项服务的背景是攻击方可以用自动化漏洞挖掘代理全天候工作，而开源维护者大多只能利用业余时间修补漏洞，防御资源明显不对等。
技术机制上，Deep Scan 先对仓库做完整的攻击面测绘，梳理所有入口点、信任边界和权限校验逻辑，然后像渗透测试人员一样沿攻击者视角走完整条利用路径，覆盖整个代码库而非仅做表层扫描。这种方式能发现传统静态检查容易漏掉的组合漏洞。
对开源生态来说，免费的高质量安全扫描降低了维护者的防御成本，尤其在自动化攻击工具普及后，这种服务模式可能成为安全厂商支持开源项目的常见做法。
Exploit agents work 24/7, open source maintainers work after hours. that problem need to be solved.
@coderabbitai put $1M into free Deep Scans for open-source maintainers: 1,215 high or critical findings across 1,125 public repos, 75 already fixed, at no cost to the projects.
@coderabbitai's Deep Scan first maps every entry point, trust boundary and access check in a repo, then walks the paths an attacker would take, like a penetration tester covering the whole codebase.
This report is categorized under AITOP's "Products" desk, focusing on US frontier AI labs and Silicon Valley technology leaders. Within our cross-regional analytical framework, it directly maps to AI developer toolchains, coding agents, and engineering workflows and US-China foundation model benchmarks and commercialization comparison. Key entities and technical topics under continuous tracking include CodeRabbit, Deep Scan, open source, AI safety.
Source attribution: curated from rohanpaul_ai (@rohanpaul_ai).
