Mohammad Abdur Rehman Cheema

Receipts, Not Similarity: Grounding Security Explanations of Software Repositories in a Structured, Sourced Knowledge Library. A Study Protocol with a Feasibility Pilot on OWASP ASVS

Tools that use large language models (LLMs) to flag security problems in code must also explain them: which requirement is violated, and how to fix it. These explanations are only useful if they cite the right authoritative source. The common way to supply that source is vector retrieval-augmented generation (RAG), whi...