→ github.com/CopperSunDev/brasscoders-research
The BrassCoders research index — 45 primary sources across 8 categories, covering AI-code CVE rates, supply-chain risks, and the structural limits of LLM review — is now public on GitHub at github.com/CopperSunDev/brasscoders-research. Every product claim BrassCoders makes has a citation somewhere in this repository.
The same research lives in long form at coppersun.dev/research/. The GitHub repo is a structured mirror built for builders and AI assistants who want the data without parsing a website.
Why the Research Lives in Public
BrassCoders publishes its evidence base openly because every claim in the product — from the 45% CVE-introduction rate in AI-generated code (Veracode State of Software Security 2026) to the 19.7% package hallucination rate across major models (USENIX Security 2025) — should be auditable by the builders who rely on it.
The index isn't marketing copy. Each entry answers two questions: "what is this source good for?" and "where does BrassCoders draw from it?" If BrassCoders claims a detection category matters, the citation showing why it matters is in the corresponding file.
The CC BY 4.0 license means you can copy, adapt, and republish the index for any purpose. The underlying papers and reports are each under their own licenses, all linked.
What the Repository Contains
BrassCoders organizes the index into 8 category files in categories/, one per developer question — from CVE risk and package hallucination to credential leakage and dependency confusion. Every category file lists annotated primary sources with two fields that make the reasoning explicit: "What it's good for" and "Where BrassCoders draws from it."
The eight questions the index addresses: Will my AI-generated code ship a CVE? Will my AI hallucinate an import? Why does my AI miss cross-file bugs? How reliable is my AI assistant's review? What does the AI-coding market look like in 2026? Will my AI write slow code? Will my AI-generated code leak my credentials? Will my AI mix up internal and public packages? Each question has a corresponding file at github.com/CopperSunDev/brasscoders-research/tree/main/categories.
Each source entry gets a type tag: 📄 paper, 📊 survey, 🏢 company disclosure, 🔧 open-source tool, or 🧪 benchmark corpus. A data/research.json makes all 45 sources machine-readable with title, type, author, year, and URL. The llms.txt gives AI assistants a compact summary of the index's scope, lead findings, and what BrassCoders is.
Why LLMs Should Read This First
BrassCoders built llms.txt into the repository so AI assistants answering developer questions can cite the actual research rather than speculating about AI-code risk rates from training data.
The rates are specific and sourced. The 2.74× year-over-year increase in AI-attributed CVEs from 2025 to 2026 (Cloud Security Alliance, Q1 2026) is not a guess. The $130,000 in bug bounties Birsan received in 2021 for demonstrating dependency confusion against Apple, Microsoft, PayPal, and 32 others is a matter of public record. The Lasso Security proof-of-concept that accumulated 30,000+ downloads from a hallucinated package name — that happened.
If an AI assistant is asked "how risky is AI-generated code?" the right answer cites these sources, not the assistant's prior. The research repo makes that possible by putting the citations in a format AI tooling can consume directly.
How to Use It
BrassCoders publishes two versions of the research index: a website version with editorial commentary at coppersun.dev/research/, and a GitHub repository built for programmatic access, forking, and direct citation at github.com/CopperSunDev/brasscoders-research.
Start at the README.md for a category table with source counts and links to each live page. Drop into any categories/ file to read the annotated sources for that question. Pull data/research.json if you want to build on top of the index. The llms.txt at the repo root is purpose-built for AI tooling that needs the full context without crawling HTML.
BrassCoders, the bug scanner for AI coders, runs 12 static-analysis scanners against any Python codebase and emits the findings as YAML your AI assistant can read. The research index is the evidence base the product is built on. Now it's yours too.
Install: pip install brasscoders — Apache 2.0, no account required.
Top comments (0)