Launching today
Sieve by Fendora
AI that filters security scanner false positives
2 followers
AI that filters security scanner false positives
2 followers
Security scanners produce 80-90% false positives. Engineers stop looking. Real vulns hide in the noise. Sieve is an ML filter trained on 1,442 labeled findings across 26 repos. It scores each Semgrep finding and posts only the real ones as a PR comment. - 95% precision on unseen repos - 4 lines of YAML, zero config - Learns from feedback - Open source (Apache 2.0)
Hey PH! 👋 Mohi here, founder of Fendora.
I built Sieve after watching teams disable their security scanners entirely, not because the tools were bad, but because 9 out of 10 findings were noise. The real vulnerabilities were there. They just got buried.
The fix wasn't more rules or better suppression lists. It was learning from data. We hand-labeled 1,442 findings across 26 repos, including intentionally vulnerable apps like OWASP Juice Shop and WebGoat, but also real production codebases like Grafana, Kubernetes, and Ghost. Then we iterated 20 times until the model could generalize to repos it had never seen.
The result: 95% precision on unseen repos, and it takes just 4 lines of YAML to add to any existing CI pipeline.
🚀 Sieve is live on the GitHub Marketplace!
Install the GitHub App with zero YAML and a one-click setup:
https://github.com/marketplace/sieve-by-fendora
The GitHub Action is available too, if you prefer integrating it directly into your CI pipeline.
Would love to hear from anyone who has fought the false positive battle. What made you give up on your scanner, or what kept you fighting? 👇