https://sofiaoreis.com/en/blog Notes on software security, static analysis, and AI. en Mon, 22 Jun 2026 18:04:40 GMT https://sofiaoreis.com/en/blog/controls-for-ai-assisted-code https://sofiaoreis.com/en/blog/controls-for-ai-assisted-code Fri, 12 Jun 2026 00:00:00 GMT You can't ban AI coding tools, and you shouldn't. Practical controls, and quick developer and DevSecOps tips, to treat AI-assisted code as the supply-chain risk vector it is. https://sofiaoreis.com/en/blog/ai-generated-code-and-the-cra https://sofiaoreis.com/en/blog/ai-generated-code-and-the-cra Fri, 05 Jun 2026 00:00:00 GMT Under the EU Cyber Resilience Act, the manufacturer is liable for the security of every component, including the code and dependencies your AI tools introduce. https://sofiaoreis.com/en/blog/what-is-the-cra https://sofiaoreis.com/en/blog/what-is-the-cra Mon, 25 May 2026 00:00:00 GMT A plain-English primer on the EU Cyber Resilience Act: who it covers, the six obligations, the deadlines that actually matter, and why most of it is just good security. https://sofiaoreis.com/en/blog/slopsquatting-hallucinated-packages https://sofiaoreis.com/en/blog/slopsquatting-hallucinated-packages Fri, 15 May 2026 00:00:00 GMT LLMs don't just write code, they pick dependencies, and sometimes the packages they recommend don't exist. Attackers have noticed. https://sofiaoreis.com/en/blog/do-llms-prefer-insecure-code https://sofiaoreis.com/en/blog/do-llms-prefer-insecure-code Sun, 10 May 2026 00:00:00 GMT Across security-sensitive tasks, most language models lean toward the insecure implementation by default. Our ICST 2026 research, and the broader industry data on why. https://sofiaoreis.com/en/blog/welcome-to-the-blog https://sofiaoreis.com/en/blog/welcome-to-the-blog Fri, 01 May 2026 00:00:00 GMT Why I started this blog: bits of what I do and see in my research, plus notes on being a researcher, professor, and founder (with some time in big tech during my PhD).