VulnMap

VulnMap is a proof-of-concept security scanner Andrew built and described in January 2025. It is not open source. There is no public repository for it.

What it does

Traditional scanners match code against a database of known vulnerabilities and then emit a short warning. VulnMap tries a different report. It scores Python on a continuous risk scale from 0 to 1 and paints the file as a heat map: cooler for lower scores, hotter for higher ones. The aim is a description a developer can read, plus a suggested change, rather than only a CVE identifier.

It is a complement to a database scanner, not a replacement. A database scanner is still the right tool for a known advisory. VulnMap was built to say something about patterns that do not already have a signature, and to show the result as a gradient instead of a pass or fail.

How it was trained

The training pairs came from GitHub's Security Advisory database. Each advisory points at a fix. The code before the fix and the code after it are a labeled pair, and the advisory's severity was kept as a number from 0 to 1 instead of a Low/Medium/High bucket. That continuous label is what the heat map is drawing. The tokenizer was CodeBERT's, so the model saw code tokens rather than plain prose tokens. The collection scripts saved severity, commit messages, and surrounding context, and they were written to be rerun when new advisories appear.

The model starts from Microsoft's CodeBERT. A regression head on top produces the continuous score. Only the last six transformer layers were unfrozen, which keeps the pretrained understanding of code and limits the training to the layers that were being asked to learn the new signal. The loss was mean squared error. Training used a warmup, separate learning rates for different parts of the network, and early stopping.

The run Andrew described used three H100 GPUs rented on Vast.ai for about $5, with distributed data-parallel training, mixed precision, and TensorFloat-32.

What the interface shows

The demo is a Flask app. You give it a Python file. A few seconds later each line is colored from blue toward red, and hovering a line shows the score. The write-up also describes a plain-language explanation and a suggested fix for the lines the model treats as risky. Flask was a prototype choice, not a production server.

Status

The published system is Python only, because the model and the advisory pairs are language-specific. The collection, training, and drawing steps were built so another language would mean new pairs and a new tokenizer pass, not a new product. That expansion has not shipped. VulnMap remains a proof of concept, and the code and weights are not public.