Lack of independent verification and review processes for software outputs and AI systems

Signals over time

2 observed signals across 1 sources, tracked for 6 days. Confidence: low.

What people are saying Observed

• “Nittim: security audit for AI-written code, now a Cursor plugin. I built nittim, an independent security audit for code written with an AI assistant. It’s now a Cursor plugin: https://cursor.directory/plugins/nittim What it does from inside Cursor, over MCP: Free scan of any public GitHub repo for committed secrets and dependencies with known CVEs. No key, no sign-in. Audit: an AI read of the code that comes back with findings at the exact file and line, and a fix for each. Your first one is free when you sign in with GitHub or Google; after that about $5. Paid tools show the price first and never run until you confirm. A free self-review rubric your agent can run locally on its own plan, nothing sent anywhere. Why I built it: the agent that wrote the code shouldn’t be the only thing that reviews it. Scanners give the audit a floor a model can’t argue away, and every finding comes with evidence you can check. If it flags something that isn’t really a problem, tell me here. False positives are the failure mode I care most about. 1 post - 1 participant Read full topic”

  RSS Feeds · complaint

• “My thoughts are similarly to SOC 2 type 2, which is that you can do different types of independent audits, whether it be financial, internal controls, cyber security. But you still need to build the bounds of what you want and what the expectations are. If you're going to audit software, you need to know what the expectations were when building the software. Also, AI Assurance is becoming a large field in where these issues are being addressed and it is being performed by independent people. Part of this auditing story is that it has also introduced lines of defense, so large companies have line 1, line 2 and line 3, all being different degrees of independence. Basically this article is simply reminding us that you need independent review and verification and you can't trust the product to verify itself. It's nothing new, you need to review the outputs and the mechanics of everything that is important to the organisation. You must trust but verify all outputs and the tools should be able to provide you with that information AND someone must check it.”

  Hacker News · complaint