# 24H

- **Event:** [Meta Global AI Developer Hackathon](https://cerebralvalley.ai/e/meta-ai-developer-hackathon)
- **When:** Oct 26, 12:00 PM – Nov 4, 9:00 PM (EST)
- **Where:** Online
- **Team:** [Daniyal Anis](https://cerebralvalley.ai/u/daniyalanis)
- **GitHub:** https://github.com/cricsion/cerberus
- **Demo video:** https://www.youtube.com/watch?v=eZmzcqtVEtA
- **Gallery:** https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery
- **Page:** https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/3036

Static application security testing (SAST) tools routinely miss contextual business-logic flaws, while naive LLM scanners flood engineering teams with high-confidence hallucinations. A model can hypothesize a flaw, but without structural context or runtime verification, it cannot tell if a vulnerability is reachable or mitigated by upstream controls.
Cerberus pushes the frontier of autonomous software capabilities by turning Meta’s models into a mechanically grounded vulnerability hunting and verification engine. Rather than accepting model outputs as final verdicts, Cerberus treats them as untrusted hypotheses that must survive multi-stage static and dynamic validation:
AST CodeGraph Intelligence & Pre-filtering: Cerberus parses source trees across 13+ languages using Tree-sitter grammar helpers and indexes them into a relational SQLite .codegraph capturing symbol definitions, calls, and references edges. It pairs this with ~40 stack-aware pattern groups (tools/sast.py) to gather contextual signals across injection sinks, SSRF, deserialization, and authentication boundaries.
Deterministic Module Partitioning: An indexed partitioner breaks large repositories into focused hunter units by analyzing module structures, directory proximity, graph links, and size budgets—giving models deep, bounded context without token-window exhaustion.
Hunter & Validator Swarms: Specialized hunter agents inspect code units to identify attack vectors. Findings are routed into validation cells where independent validator agents cast discrete status votes (confirmed, fp, needs-review). Findings require a strict majority (1–5 configurable votes) to escalate; ties default to needs-review.
Dual-Control Sandboxed Verification: High-severity findings can be dynamically verified inside a resource-capped execution runtime (local read-only FS or Docker containers capped at 2 CPUs and 2 GB RAM). A model-synthesized reproduction script is certified as proven only when all reproduction runs exit 0 with a line-anchored [POC_PROVEN] sentinel and a control run exits 0 with [POC_CONTROL_PASSED].
Standardized CI/CD Integration: Audits produce actionable artifacts including SARIF, interactive HTML dashboards, JUnit, and structured JSON logs.
In active benchmark testing across real-world open-source repositories, Cerberus demonstrates 75.3% macro recall, 72.6% macro precision, and 73.4% macro F1 across 280 validated true positives.

## More from Meta Global AI Developer Hackathon

- [Discovery Clock](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/3033)
- [Doors and Corners](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/3034)
- [Autonomous Vision Lab (Sourabh Raikwar)](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/3035)
- [Accnomos](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/3037)
- [Aljebra](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/3038)
- [Barestate](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/3039)

---

Markdown version of https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/3036. Site index for agents: https://cerebralvalley.ai/llms.txt · full text: https://cerebralvalley.ai/llms-full.txt