Visa

Sources: Visa (homepage) · OSS AI Security Harness Comparison.

Identity and role

Visa is a global payments-network company. It publishes visa/visa-vulnerability-agentic-harness on GitHub, an agentic SAST pipeline named in Semgrep’s July 2026 survey of open-source AI code-security harnesses.

Relevance to This Wiki

VVAH runs an eleven-stage flow, per Semgrep’s LLM-generated summary of the repository, that Visa built on learnings from Anthropic’s Project Glasswing.¹ The pipeline threat-models a target with STRIDE, decomposes it into taint chunks, and adversarially verifies each finding before proposing and scoring a fix, all without executing code. Semgrep records the project at about 600 GitHub stars and licensed Apache 2.0.² Its LLM-generated sections add that the repository is closed to external contributions.¹

Semgrep recommends VVAH to an AppSec program optimizing time-to-reviewed-fix, describing it as broad-language SAST with real triage rigor at the cost of a frontier-model dependency and no runnable proof of concept. VVAH’s default configuration uses Claude Sonnet 4.6 for detection and Claude Opus 4.8 for remediation and validation, per the same LLM-generated summary.¹

Outputs / Products

• VVAH (visa-vulnerability-agentic-harness) — eleven-stage agentic SAST pipeline across 42 languages and six specialist lenses; proposes and LLM-validates fixes; exports SARIF.¹

See Also

• VVAH — the product covered here.
• OSS AI Security Harness Comparison — source.
• Anthropic — VVAH draws on learnings from Anthropic’s Project Glasswing.

Footnotes

1. From Semgrep’s LLM-generated summary of the repository, not the survey’s human-written body. ↩ ↩² ↩³ ↩⁴

2. Star count as reported by Semgrep in its July 2026 survey; a point-in-time figure. ↩