Blog · Company
Hello, world
This is the LeoTrace blog. We will use it to write about what AI coding agents get wrong when it comes to security, about building LeoPrevent, and about how we know whether what we build actually helps.
LeoTrace builds LeoPrevent. It sits beside a coding agent such as Claude Code, reviews the code the agent wrote when it finishes its turn, and tells the agent about the security problems it finds, so they can be fixed in the same turn instead of in a code review days later. It also points out problems that were already in the code before the agent touched it.
Coding agents now write a large share of new code, and they write insecure code at a steady rate. Telling them to be careful isn't enough (we have measured that), and nothing checks the change before it lands. We work on that last part.
What you will find here
- What agents do. Patterns we see in the code agents write, and in how they respond when told about a flaw.
- How it works. The design decisions behind LeoPrevent, including the ones we got wrong first.
- How we measure. We test coding agents, with and without LeoPrevent, on public security benchmarks, decide the analysis before we look at the results, say so when we change it afterwards, and publish the verdicts behind every number. The results themselves live in their own section, Benchmarks, and we write about them here.
Every result we publish includes the verdicts behind it, including where LeoPrevent made no clear difference. The first post about what we found is Coding agents copy your security mistakes.