# vexproof

- **Event:** [Meta Global AI Developer Hackathon](https://cerebralvalley.ai/e/meta-ai-developer-hackathon)
- **When:** Oct 26, 12:00 PM – Nov 4, 9:00 PM (EST)
- **Where:** Online
- **Team:** [henry mbugua](https://cerebralvalley.ai/u/henrymbuguak)
- **GitHub:** https://github.com/henrymbuguak/vexproof
- **Demo video:** https://www.youtube.com/watch?v=degGH4wwkEk
- **Gallery:** https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery
- **Page:** https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/890

Dependency scanners check versions, not code. If you install a vulnerable version of a package, you get an alert, even if your code never calls the function with the bug. A small Django shop gets 94 alerts, and nobody can tell which ones matter.

vexproof answers that with evidence, for Python projects, without running them. It reads each advisory and the commit that fixed it, maps the fix to the functions it changed, and searches for call paths from the project's code to those functions. Meta's Muse Spark does the reading that static analysis can't: it picks which changed function the advisory is about, quoting the advisory to justify the pick, and judges call-path steps whose target is only known at run time. A deterministic verifier checks every model answer before vexproof uses it. The AI proposes; the verifier proves.

For the shop: 14 alerts proven reachable with a verified call path, 14 proven unreachable, and 66 left open with a reason, because vexproof never marks an alert harmless without proof. Results are ranked (fix now, fix soon, review), with an upgrade plan and an OpenVEX export, in an accessible web app (WCAG 2.2 AA) or the CLI.

I checked it against reality by running two Django projects under scripted workloads: 0 of 30 clears were contradicted, 0 of 1,246 loaded modules were missed, 25 of 29 reachable paths really ran, and Muse Spark's picks matched 22 of 22 hand-checked answers.

## More from Meta Global AI Developer Hackathon

- [Focus](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/887)
- [ScheduleSolve AI](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/888)
- [Lives in Motion](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/889)
- [Tom.Appdev](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/891)
- [CiK7](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/892)
- [DAARS Instruments | TurnProof](https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/893)

---

Markdown version of https://cerebralvalley.ai/e/meta-ai-developer-hackathon/hackathon/gallery/890. Site index for agents: https://cerebralvalley.ai/llms.txt · full text: https://cerebralvalley.ai/llms-full.txt