Sourcegraph Blog
25 stories
Sourcegraph BlogToolsphp2shell: patching PHP is easy, finding it is the hard part PHP patched two critical unauthenticated RCE bugs, CVE-2026-109618 and CVE-2026-109619. Find every PHP runtime in your code with Deep Search, then bump them all with Agentic Batch Changes.
Sourcegraph BlogToolsThe runbook is out of date and the code shipped an hour ago Runbooks already lagged behind code, and AI-assisted development is widening the gap. A former SRE explains how Code Search, Deep Search, and MCP ground incident response in the code itself.
Sourcegraph BlogToolsThe autonomous codebase What's left for us to build?
Sourcegraph BlogToolsCoding agents usually can't price on outcomes. Ours can. Agentic Batch Changes is now available, and we price it on outcomes: you only pay for changesets that merge.
Sourcegraph BlogToolsIntroducing Agentic Batch Changes: the frontier agent for code change at scale Codebase-wide changes across hundreds or thousands of repositories can now be run by one engineer.
Sourcegraph BlogToolsA smarter way to run code migrations with less LLM context Deep Search runs scripts in a sandbox around Sourcegraph search APIs, so a migration audit returns a CSV checklist instead of thousands of files worth of tokens.
Sourcegraph BlogToolsHow to evaluate Sourcegraph on your own codebase Better code retrieval does not automatically mean better task completion. Here is how to measure retrieval, agent performance, and cost without confusing one for another.
Sourcegraph BlogToolsCompliance-first AI: proving agent provenance for regulated engineering teams Regulated engineering teams must prove which files an AI agent read before it shipped a change. How scoped retrieval turns agent context into an audit trail.
Sourcegraph BlogToolsCode Finder: fast, efficient code search for coding agents Code Finder runs its own search loop and hands your coding agent the exact files and line ranges, faster and cheaper than the agent searching on its own.
Sourcegraph BlogToolsThree places enterprise security breaks down at codebase scale (and why your current tools don't cover them) Vulnerability remediation breaks down at codebase scale: AI code without context, detection coverage gaps, and fixes that take weeks across 10,000 repos.
Sourcegraph BlogToolsDetection in one repo isn't a security posture A finding in one repo is a fact. A security posture means knowing whether that same problem exists everywhere else, and fixing it before it spreads.
Sourcegraph BlogToolsAgentic Batch Changes is now in public beta Agentic Batch Changes is now in public beta: an AI agent that scopes, executes, and ships large-scale code migrations across hundreds of repositories until every PR is mergeable.
Sourcegraph BlogToolsOn owning a codebase, and why it may be the hardest job in software AI coding agents are producing more code than ever, but the world still runs on massive, decades-old codebases. Why owning and understanding them may be the hardest job in software.
Sourcegraph BlogToolsWhy your migration tools are failing your engineers The bottleneck in most large-scale migrations is not the engineers or the plan. It is that the tools cannot see the whole codebase.
Sourcegraph BlogToolsSourcegraph MCP server and a cheaper model beat a Mythos-class model alone On nine CodeScaleBench tasks designed to evaluate agent effectiveness in large codebases, Claude Sonnet 4.6 with the Sourcegraph MCP server outscored Fable 5, winning six of nine at roughly half the…
Sourcegraph BlogToolsThe hidden cost of code that nobody touches Every engineering org has the files nobody wants to open. Here's what that actually costs.
Sourcegraph BlogToolsAutomating Security Triage with HackerOne and Deep Search How Sourcegraph uses HackerOne webhooks and Deep Search to automatically validate, triage, and investigate vulnerability reports before engineers start their day.
Sourcegraph BlogToolsSecurity Automation Evolved: From SlackOps to Programmatic SIEM Triage (Part 1/2) How Sourcegraph's security team evolved from a Slack-based triage bot to programmatic SIEM detection with expression-based auto-close rules.
Sourcegraph BlogToolsDependency prefixes are a supply chain risk: let's fix them Dependency prefixes like ^ and ~ make updates easy, but the version ranges they create widen the path a compromised package can take into production.
Sourcegraph BlogToolsHow we're using Sourcegraph and a Slack bot to detect vulnerabilities and react quickly A Slack bot triages every GitHub advisory, posts a rocket-to-trigger ask in the channel, and on one human reaction runs the full content pipeline: detection queries, blog scaffold, social drafts, a…
Sourcegraph BlogToolsWhy coding agents fail in large codebases (and what to do about it) Data from 1,281 agent runs across 40+ large open source repos reveals five repeatable failure patterns in coding agents, and the infrastructure fixes for each.
Sourcegraph BlogToolsLessons on UX, security, and scale when building an enterprise-grade Slack agent We built a Deep Search Slack agent for large companies. Here is what we learned about user experience, enterprise security, and Redis-backed rate limiting.
Sourcegraph BlogToolsCode Search, Deep Search, or MCP: When to Use Each AI added new ways to search code, but not all of them apply to every problem. Here’s how to choose between Code Search, Deep Search, and MCP.
Sourcegraph BlogToolsWhat it actually takes to run code intelligence in-house We audited what it would take to build a Sourcegraph equivalent internally, mapped the platform to 90 engineering requirements across 10 categories, and modeled 3-year costs for different environment…
Nothing matches this filter yet.