PHP patched two critical unauthenticated RCE bugs, CVE-2026-109618 and CVE-2026-109619. Find every PHP runtime in your code with Deep Search, then bump them all with Agentic Batch Changes.
Read more
Runbooks already lagged behind code, and AI-assisted development is widening the gap. A former SRE explains how Code Search, Deep Search, and MCP ground incident response in the code itself.
Read more
What's left for us to build?
Read more
Agentic Batch Changes is now available, and we price it on outcomes: you only pay for changesets that merge.
Read more
Codebase-wide changes across hundreds or thousands of repositories can now be run by one engineer.
Read more
Deep Search runs scripts in a sandbox around Sourcegraph search APIs, so a migration audit returns a CSV checklist instead of thousands of files worth of tokens.
Read more
Better code retrieval does not automatically mean better task completion. Here is how to measure retrieval, agent performance, and cost without confusing one for another.
Read more
Regulated engineering teams must prove which files an AI agent read before it shipped a change. How scoped retrieval turns agent context into an audit trail.
Read more
Code Finder runs its own search loop and hands your coding agent the exact files and line ranges, faster and cheaper than the agent searching on its own.
Read more
Vulnerability remediation breaks down at codebase scale: AI code without context, detection coverage gaps, and fixes that take weeks across 10,000 repos.
Read more
A finding in one repo is a fact. A security posture means knowing whether that same problem exists everywhere else, and fixing it before it spreads.
Read more
Agentic Batch Changes is now in public beta: an AI agent that scopes, executes, and ships large-scale code migrations across hundreds of repositories until every PR is mergeable.
Read more
AI coding agents are producing more code than ever, but the world still runs on massive, decades-old codebases. Why owning and understanding them may be the hardest job in software.
Read more
The bottleneck in most large-scale migrations is not the engineers or the plan. It is that the tools cannot see the whole codebase.
Read more
On nine CodeScaleBench tasks designed to evaluate agent effectiveness in large codebases, Claude Sonnet 4.6 with the Sourcegraph MCP server outscored Fable 5, winning six of nine at roughly half the cost for each point of quality.
Read more
Every engineering org has the files nobody wants to open. Here's what that actually costs.
Read more
How Sourcegraph uses HackerOne webhooks and Deep Search to automatically validate, triage, and investigate vulnerability reports before engineers start their day.
Read more
How Sourcegraph's security team evolved from a Slack-based triage bot to programmatic SIEM detection with expression-based auto-close rules.
Read more
Dependency prefixes like ^ and ~ make updates easy, but the version ranges they create widen the path a compromised package can take into production.
Read more
A Slack bot triages every GitHub advisory, posts a rocket-to-trigger ask in the channel, and on one human reaction runs the full content pipeline: detection queries, blog scaffold, social drafts, a 35-second auto-cut demo. The operator's remaining job is to read the drafts and decide whether they're honest.
Read more