repo-audit: detection via HF Inference (Qwen3-Coder-480B), 7B keeps refutation

README.md

@@ -42,10 +42,11 @@ input): only the real one survives, with its PoC.
 - **Whole-repo, split by model size, both via HF Inference** — detection on
   [Qwen3-Coder-480B-A35B-Instruct](https://huggingface.co/Qwen/Qwen3-Coder-480B-A35B-Instruct): a
   whole-file view follows a long source→sink data-flow (an injection can be ~200 lines from its
-  sink) the small model misses. Refutation on a small model (Qwen2.5-Coder-7B) over a **tight,
-  line-numbered window** around each candidate — a focused context is what lets it confirm a real
-  finding and drop false positives (a whole file misleads it: it excuses an LFI on a `file_exists`
-  guard). Both stages off-GPU, so a whole-repo scan has no length limit.
+  sink) the small model misses. Refutation on **Qwen2.5-Coder-32B** over a **bounded, line-numbered
+  window** around each candidate: it must *credit* real sanitization (prepared statements, allow-lists,
+  casts) to drop false positives — a 7B refuter can't and confirms almost everything — while not being
+  fooled by `file_exists`/`isset` guards (which don't stop an LFI). Both stages off-GPU, so a whole-repo
+  scan has no length limit.
 
 Paste any snippet, pick the language, audit. All example code is fictional and **intentionally
 vulnerable** — it's the test set. This is a **defensive / educational** demo, not a production scanner.

app.py

@@ -38,19 +38,20 @@ MAX_FINDINGS = int(os.environ.get("MAX_FINDINGS", "5"))
 # The repo audit runs BOTH stages on HF Inference by default:
 #  - detection on a LARGE model (480B): whole-file detection needs a wide view + a long data-flow
 #    (source→sink can be ~200 lines apart, e.g. an LFI through an object), which the 7B misses.
-#  - refutation on a SMALL model (7B) over a TIGHT window: a focused context is what lets it confirm
-#    a real finding (a whole file misleads it — it excuses an LFI on a nearby file_exists guard).
+#  - refutation on a CAPABLE model (32B) over a bounded window (±REFUTE_CTX): the refuter must CREDIT
+#    real sanitization (prepared statements, allow-lists, casts) — a 7B refuter can't, so it drowns the
+#    report in false positives — while not being fooled by file_exists/isset guards (see REFUTE_SYS).
 # Both off-GPU ⇒ a long whole-repo scan needs NO ZeroGPU reservation, so there is no proxy-token to
 # expire mid-scan (the limit that capped multi-file scans). ZeroGPU is the no-token fallback.
 DETECT_BACKEND = os.environ.get("DETECT_BACKEND", "hf_inference").strip().lower()
 REFUTE_BACKEND = os.environ.get("REFUTE_BACKEND", "hf_inference").strip().lower()
 HF_INFERENCE_MODEL = os.environ.get("HF_INFERENCE_MODEL", "Qwen/Qwen3-Coder-480B-A35B-Instruct")  # detect (large)
-HF_REFUTE_MODEL = os.environ.get("HF_REFUTE_MODEL", "Qwen/Qwen2.5-Coder-7B-Instruct")  # refute (small, targeted)
+HF_REFUTE_MODEL = os.environ.get("HF_REFUTE_MODEL", "Qwen/Qwen2.5-Coder-32B-Instruct")  # refute (judge — needs to credit real sanitization)
 HF_TOKEN = os.environ.get("HF_TOKEN")
 # Rough $/1M-token figure for cost *logging* only (the real cost shows on the HF billing dashboard).
 USD_PER_MTOK = float(os.environ.get("HF_INFERENCE_USD_PER_MTOK", "0.9"))
 REFUTE_CHUNK = int(os.environ.get("REFUTE_CHUNK", "6"))   # candidates per ZeroGPU call (zerogpu fallback only)
-REFUTE_CTX = int(os.environ.get("REFUTE_CTX", "10"))      # ± lines of targeted context for refutation (keep small)
+REFUTE_CTX = int(os.environ.get("REFUTE_CTX", "60"))      # ± lines of context for refutation (enough to see the local sanitization, not the whole file)
 
 _inf_client = InferenceClient(token=HF_TOKEN) if HF_TOKEN else None
 if _inf_client is None:  # no token → both repo stages fall back to the local 7B on ZeroGPU
@@ -237,8 +238,8 @@ Audit a **whole public repository**. It clones shallow (or unpacks your `.zip`)
 sandbox, ranks the code files **by security relevance**, and scans the top ones **file-by-file with
 streaming** — two stages **split by model size**: detection runs on a large model
 (**Qwen3-Coder-480B**) that can follow a long source→sink data-flow across a whole file, then each
-candidate is **adversarially refuted by a small model (Qwen2.5-Coder-7B) on a tight context** so
-false positives are dropped — both via **HF Inference**.
+candidate is **adversarially refuted by Qwen2.5-Coder-32B on a bounded context** — it credits real
+sanitization (prepared statements, allow-lists) and drops false positives — both via **HF Inference**.
 **Static analysis only — the target code is never executed. Public / authorized repos only.**
 
 ⏱️ A scan uses HF Inference credits (both stages, off-GPU — no scan-length limit). Try
@@ -248,7 +249,7 @@ false positives are dropped — both via **HF Inference**.
 ABOUT = """
 ---
 Snippet: **Qwen2.5-Coder-7B** on **ZeroGPU** · whole-repo: detect **Qwen3-Coder-480B** + refute
-**Qwen2.5-Coder-7B**, both via **HF Inference** · static analysis, no code execution, no secrets · built by
+**Qwen2.5-Coder-32B**, both via **HF Inference** · static analysis, no code execution, no secrets · built by
 [Ferr0](https://huggingface.co/Ferr0) · [pixelium.win](https://pixelium.win) · [GitHub](https://github.com/ferr079)
 """
 

engine.py

@@ -17,20 +17,23 @@ DETECT_SYS = (
     "ignore pure style, quality or error-handling nits. Use 1-based line numbers."
 )
 REFUTE_SYS = (
-    "You are an exploit analyst verifying ONE claimed vulnerability in the given code. Decide "
-    "whether it is GENUINELY exploitable.\n"
-    "- EXPLOITABLE (exploitable=true): untrusted input reaches a dangerous sink without adequate "
-    "validation/sanitization, AND you can give a concrete proof-of-concept input. Example: a "
-    "shell command built by concatenating an unsanitized parameter is exploitable.\n"
-    "- FALSE POSITIVE (exploitable=false): the attacker-controlled input is constrained to a SAFE "
-    "set before the sink (cast to int, allow-listed, properly escaped or parameterized) or the "
-    "sink is unreachable (dead code).\n"
-    "A check that does NOT restrict the attacker-controlled VALUE is NOT adequate, do not be "
-    "fooled by it: e.g. file_exists()/is_file() before include/require still allows path traversal "
-    "to any existing file (LFI), and an isset/empty/length/non-empty check does not stop "
-    "injection. Such guards do NOT make a finding a false positive.\n"
-    "Be rigorous BOTH ways: do not confirm vague suspicions, but do NOT dismiss a real, "
-    "reachable, unsanitized sink. If exploitable, set exploitable=true and give the PoC input."
+    "You are an exploit analyst verifying ONE claimed vulnerability in the given code. Decide if it "
+    "is GENUINELY exploitable. Judge ONLY what the code shows.\n"
+    "- EXPLOITABLE (exploitable=true): attacker-controlled input reaches the dangerous sink with NO "
+    "adequate sanitization in between; give a concrete proof-of-concept input.\n"
+    "- FALSE POSITIVE (exploitable=false): adequate protection on the value before the sink — a "
+    "prepared/parameterized query, an allow-list of permitted values, a cast to a safe type, proper "
+    "escaping (escapeshellarg, htmlspecialchars), or strict value validation (is_numeric on the whole "
+    "value). Also FP if the sink is unreachable/dead code, or the input is not attacker-controlled. "
+    "If a proper sanitization like that is visible, it IS a false positive — say so.\n"
+    "Two traps, do NOT fall for them:\n"
+    "1. An EXISTENCE/presence check is NOT sanitization. If attacker input is used to build a path "
+    "passed to include/require/file_get_contents/fopen/readfile — EVEN with a fixed directory prefix, "
+    "a forced extension (.php), or a file_exists()/is_file() guard — it IS EXPLOITABLE (path traversal "
+    "/ LFI): the attacker still controls which file loads, and such prefix/suffix/existence constraints "
+    "are routinely bypassed (../, encoded traversal, existing sensitive files).\n"
+    "2. isset/empty/strlen do not stop injection.\n"
+    "If exploitable, set exploitable=true and give the PoC input."
 )
 
 SEV = {"critical": "🔴", "high": "🟠", "medium": "🟡", "low": "⚪"}