Google’s Validation Pipeline
Google says it inspects each infrastructure edit covering hundreds of millions of code lines, blocking vulnerabilities in their hundreds monthly before repository or production entry.
Its evolved open-source Mantis coordinates reviewers with local attacker models, current repository facts and maps of interdependent function calls. Narrow changes limit context; some reported false-alarm results reach 3%. Others may lack that context.
Specialised triage uses abstract program trees, following calls and consulting safety conditions indexed beforehand to establish attacker reachability, exceeding 92% precision under a minute. Overnight integration tests catch interactions between changes. A fixing agent uses findings and proofs for patches meeting internal standards, requiring human scrutiny.
Response
- Scan small changes before merging.
- Separate generation, scanning and triage tools and context.
- Require reachable paths or reproducible evidence, not plausible explanations.
- Maintain architecture, dependency and ownership context.
- Measure correct-flag proportions to sustain developer trust.
- Retain human approval for code changes.
These are unaudited provider results without raw samples. The displayed date is 19 September 2026; machine-readable times differ.
