Kuyash/teptez-ai

TEXT GENERATIONConcurrent Unit Cost:1Model Size:7.6BQuant:FP8Context Size:32kTool Calling:SupportedPublished:Jun 9, 2026License:apache-2.0Architecture:Transformer Open Weights Featherless Exclusive Cold

Kuyash/teptez-ai is a 7 billion parameter language model, fine-tuned from Qwen2.5-Coder-7B-Instruct, specifically designed for Static Application Security Testing (SAST) finding triage. It classifies SAST findings as true positives, false positives, or uncertain, providing CWE labels, confidence scores, and remediation guidance. Optimized for identifying and suppressing false positives in injection-type vulnerabilities, it significantly improves triage efficiency by reducing analyst workload.

Loading preview...

teptez-ai: SAST Finding Triage Model

teptez-ai is a 7B-parameter LLM, fine-tuned from Qwen2.5-Coder-7B-Instruct, to automate the triage of Static Application Security Testing (SAST) findings. It processes SAST findings (title, CWE, severity, code snippet, taint flow) and outputs a structured JSON verdict: true_positive, false_positive, or uncertain, along with confidence, explanation, and remediation.

Key Capabilities & Differentiators

  • Automated SAST Triage: Reduces the manual effort of security analysts by classifying findings.
  • False Positive Suppression: Specifically fine-tuned on production security scan data to identify and suppress false positives, particularly in high-volume injection categories.
  • Performance: Achieves a 79% relative improvement in Youden's J statistic over its base model on the OWASP Benchmark v1.2, primarily by cutting the false positive rate.
  • Strong on Injection Classes: Significantly outperforms the base model on CWEs like Command Injection (CWE-78), SQL Injection (CWE-89), XSS (CWE-79), and Path Traversal (CWE-22).
  • Structured Output: Provides a JSON output including verdict, confidence, cwe, explanation, and remediation.

Recommended Usage

teptez-ai is best used as a gated false positive suppressor for specific injection-class CWEs (CWE-78, -79, -89, -22, -330). It is recommended to only suppress findings with a false_positive verdict and a confidence score above 0.75. The model has known limitations, including a severe regression on CWE-614 (Secure Cookie) and near-zero performance on crypto, authz, and timing categories, which should be escalated to human analysts or frontier models.

Finetunes
1 models