Hedge

The description states:

• Hedge is an evidence-linked security architecture diff for TypeScript pull requests.
• It compares base and head revisions to build an attack-surface graph and report architectural deltas.
• It supports specific frameworks like Next.js App Router, Pages API routes, Express routes, and middleware.
• It produces outputs including HTML diffs, Markdown reports, SARIF, JSON graphs, GitHub annotations, and proof bundles.

Inference Hedge appears to be a developer tool that integrates into CI/CD workflows via GitHub Actions and CLI. Its core functionality involves analyzing code structure for architectural risk, not line-level vulnerabilities or generic scanning.

The description states:

• Hedge is deliberately not a "generic AI security scanner."
• It surfaces supported attack-surface changes and design risks, not vulnerabilities.
• It does not claim to find or prove vulnerabilities.
• The tool uses deterministic architecture analysis before involving AI models.

Inference Hedge positions itself as a precision-focused tool for architectural risk detection in code review, rather than a broad vulnerability scanner. It emphasizes accuracy over generality and separates model interpretation from final decision-making.

The description states:

• Hedge targets developers working with TypeScript-based web frameworks (Next.js, Express).
• It is designed to integrate into GitHub workflows for pull request security review.
• The tool supports specific patterns such as route handlers, middleware matchers, and database/storage operations.

Inference Hedge likely targets engineering teams using modern JavaScript/TypeScript stacks who want to automate architecture-level security checks during code review. It is not positioned for general-purpose software development or non-web applications.

The description states:

• Hedge ships as a Node 24 GitHub Action and Node 22 CLI with checksum-verified releases.
• The repository includes installation diagnostics, test files, and verification workflows.
• No pricing information or commercial model is mentioned.

Inference There is no evidence of a business model or pricing structure in the description. It appears to be an open-source or internal tool built for demonstration purposes.

The description states:

• Hedge uses esbuild, GitHub Actions, Node.js, OpenAI Codex/GPT-5.6, TypeScript compiler API, Vitest, Zod.
• It separates authority across jobs in the GitHub workflow (collector, reasoning, publisher).
• It supports Next.js App Router, Pages API routes, Express routes, Prisma, object storage, outbound network, and more.
• It produces interactive HTML diffs, Markdown, SARIF, JSON, GitHub annotations, and tamper-evident proof bundles.

Inference Hedge is technically sophisticated, leveraging both static analysis and AI for selective interpretation. Its modular architecture separates concerns and ensures trust boundaries in CI/CD pipelines.

The description states:

• 259 unit, contract, replay, workflow, and schema tests pass across 53 test files.
• All 47 bundled deterministic DriftBench cases pass.
• Source-only smoke tests on one App Router, one Pages API, and one Express repository were silent on documentation-only changes and produced exact evidence for supported upload/storage changes.
• A benign judge-lab pull request produced no Hedge comment and no model call.
• A live architecture-changing pull request completed full collect -> reason -> publish path, rejected one unsupported model proposal, cited exact evidence, and recorded a BLOCK decision.
• One remote verification run passed all four requirements and recorded HEDGE-009 as verified through a reviewable state pull request.

Inference Hedge has demonstrated functionality in controlled environments and shows maturity in deterministic behavior. However, there is no evidence of real-world adoption or usage beyond the author’s own testing.

The description states:

• Hedge is deliberately not a generic AI security scanner.
• It focuses on supported attack-surface patterns rather than broad vulnerability detection.
• No mention of competitors or market positioning beyond its own design choices.

Inference Hedge operates in a niche space focused on architecture-level change analysis, distinct from general-purpose tools like Snyk, SonarQube, or GitHub Advanced Security. It may compete with specialized tools for secure code review but lacks evidence of direct competition.

The description states:

• Model reliability and automatic remediation publication remain next-release work.
• One frozen ten-case model evaluation showed only two cases with stable exact finding/decision signatures.
• A draft patch was labeled experimental due to a pre-existing empty Vitest suite.
• The tool is built by one person (Caleb Todd) and has no external validation or traction.

Inference Key risks include incomplete automation, limited model reliability, and lack of real-world usage. The project remains in early development and lacks evidence of scalability or commercial viability.

1. Has Hedge been integrated into any production environments or CI/CD pipelines beyond the author’s own testing?
2. What is the current status of model reliability and remediation automation? Are there plans to address known limitations?
3. How does Hedge handle edge cases or unsupported frameworks, and what is the roadmap for expanding coverage?
4. Is there a plan to monetize or commercialize Hedge, or is it intended as an open-source tool?
5. What are the long-term maintenance and support plans for the project?