this looks actually pretty cool as a sort of filter pass to catch things. then do the thorough review after armed with its output. The readme is refreshingly specific and transparent about how it works, involved costs, limits / caveats. Definitely no marketing fluff in sight. Now its not my domain perse, but the readme convinced me its likely worth a look if your job entails checking/auditing linux changes. I can imagine since (as it clearly states, thank you) its probabalistic, it might be also used in a fuzzy kind of way just having it run continually or many times and only trigger on high severity things. as models improve more / new things can be found as well as just chance of hit and miss. (and yes that would also yield more FPs to sift through).

Lately there is RL being introduced into agentic / LLM based systems which might also be super useful here (so reviewers can give feedback and it improves).