Only raise a security issue you can prove. That was the idea behind a hackathon project which took first place in our Semgrep Guardian challenge at the Cyberdefense Hackathon during SF Tech Week. A static deterministic check runs first, so most saves never reach a commit at all. The findings go into the model's context as evidence. Anything the model suspects is then run in a sandbox with canaries. Only proven issues reach the developer, and each comes with a fix that’s re-checked the same way. Static analysis is cheap and precise about what the code says. A model is good at asking whether it matters in a project. Of the 63 projects submitted, this was one of the clearest examples of each security layer doing the task it’s best at. Congrats to the Reva team! #SFTechWeek#