Skip to content

Week 7 reading path

Read the notes and rerun their commands before the studio; that is the required reading. The course fixture is enough for the week: no account, installation or external service is needed. The two sources below are optional and both concern the last part of the notes' example, an agent that proposes tests or harnesses.

  • Source 1 — generated fuzz targets and what is reported about them (optional). Read the overview of the OSS-Fuzz-Gen README. Use it for one distinction: results report build success, run-time crashes and coverage separately, and the coverage denominator is the code linked into the target, not the whole project (tools/oss-fuzz-gen; as_of: 2026-09-05; Source 1; Source 2; Source 3). Ask the same of any test an agent writes for you: does it run, does it fail on a known fault, and what does its number count?
  • Source 2 — a candidate is not a verified finding (optional). Read the FuzzingBrain CRS README for how a run's artifacts keep validated triggering inputs apart from candidate patches, and why a failed build is diagnosed from its logs and is not evidence that no vulnerability exists (tools/fuzzingbrain; as_of: 2026-09-05; Source 1). Do not install or run either tool for this course.

For each source you read, write one sentence connecting its distinction to an entry in your studio record, and one sentence naming what the source does not show about your project. Factsheet cards are citations for this page; they are not published reading material.