My long-term goal is to develop a way to measure how secure a given software library or component is—essentially, to help developers assess the safety of a library before deciding to use it. Traditional vulnerability scanning hasn't been effective at uncovering unknown vulnerabilities in this context, so I’ve been exploring predictive approaches instead. In other words, I want to analyze code characteristics to estimate the likelihood of future vulnerabilities or assess the current security risk.

There are already many machine learning–based approaches for this kind of analysis, but I find myself unsure of what exactly should be done next. With the rapid advancement of LLMs, I also feel that LLM-based methods might soon overtake traditional machine learning approaches. But keeping up with LLMs is a challenge in itself, given how fast the field is evolving.