Sonar vs Tricentis

Sonar DNS Field Command Injection Fixed by Developer

A developer discovered a command injection vulnerability in the DNS custom resolver field of Sonar, a macOS network scanning tool. The field, which accepts user input for custom DNS servers like Pi-hole or NextDNS, was passed to a privileged command without proper validation, potentially allowing arbitrary code execution as root. The fix involved allowlisting input to only accept valid IP addresses, passing arguments as an array instead of a shell string, and narrowing the privileged interface. The article also details three other security fixes made during a full pass: moving API tokens from a plist to the Keychain, preventing CSV export formula injection, and implementing atomic writes to avoid data corruption.

• Sonar had a command injection vulnerability in its DNS resolver field.
• The vulnerability could allow running commands as root.
• The fix involves allowlisting IP addresses and using array arguments.

Validators Should Judge, Not Auto-Remediate

Todd Linnertz argues that AI validators in developer toolchains should only judge outputs and not perform automatic remediation. He introduces and adopts the term "verification debt" to describe the quality gap between machine-produced outputs and production-ready software, and highlights testing patterns like inner-loop vs outer-loop checks and shadow testing. Linnertz criticizes validator designs (citing Sonar's "Solve" stage) that collapse finding and fixing into one step because they erase audit trails, change the security posture, and hide authorship of changes. He recommends separating the validator (which emits a verdict) from a remediation agent (which proposes fixes) and enforcing a frozen baseline promotion gate so fixes must clear the same checks as any other change. He notes the industry has not yet settled where remediation should live.

• Author Todd Linnertz advocates that validators should judge only and not perform remediation.
• The article adopts the term "verification debt" to describe the gap between AI-produced outputs and production-quality requirements.
• Sonar's framework is described as having a "Solve" stage where the validator both finds issues and fixes them.

Tricentis Opens Riyadh Office to Support Growing Demand Across Saudi Arabia

New office marks the company's second location in the Middle East and supports enterprise and...

Tricentis Launches AI Innovations for Agentic Development

Tricentis announced a set of AI-powered technologies developed via Tricentis Labs to advance agentic quality engineering and accelerate enterprise software development. Revealed at the Tricentis Transform conference, the innovations include Tricentis Aida (an autonomous application-exploration AI agent), Tricentis AgentScore (a probabilistic framework to evaluate AI agents), and Tricentis Release Risk Intelligence (AI-driven release risk and remediation guidance). The release notes the company’s recent acquisition of Tabnine and positions Tricentis Labs as an incubator to co-develop early AI capabilities with customers and partners. The update aims to help engineering and release teams identify quality risks earlier, validate AI-powered systems, and make faster, more informed release decisions.

• Tricentis announced new AI-powered innovations at its Tricentis Transform conference.
• Three technologies were introduced from Tricentis Labs: Tricentis Aida, Tricentis AgentScore, and Tricentis Release Risk Intelligence.
• Tricentis Labs is an innovation incubator intended to give customers early access and collaboration opportunities for emerging AI technologies.