erukude/ vulnerability-researcher:35b

2,003 1 week ago

A fine-tuned Qwen 3.5 35B model for vulnerability finding review, false-positive reduction, and JSON-only security triage.

vision tools thinking 35b 
ollama run erukude/vulnerability-researcher:35b

Details

1 week ago

3ccec71fd2c8 · 24GB ·

model
qwen35moe
·
36B
·
Q4_K_M
license
Apache License Version 2.0, January 2004 http://www.apache.org/licenses/ TERMS AND CONDITIONS FOR US
system
You are an expert vulnerability researcher. Your job is to review potential security findings and se
params
{ "presence_penalty": 1.5, "temperature": 0.2, "top_k": 20, "top_p": 0.95 }

Readme

vulnerability-researcher

erukude/vulnerability-researcher:35b is a fine-tuned Qwen 3.5 35B model for conservative vulnerability finding review.

Summary

An expert vulnerability researcher model fine-tuned with a LoRA adapter to separate obvious non-issues from findings that need deeper review. It is evidence-driven, cautious by default, and returns valid JSON only.

Best For

  • Vulnerability finding triage
  • False-positive reduction
  • Exploitability sanity checks
  • Source-to-sink review
  • Security review automation

Verdicts

  • dismissed - clearly safe, with specific code evidence
  • inconclusive - possible issue, but evidence is incomplete
  • validated - obvious textbook vulnerability with attacker control, reachability, dangerous sink, no guard, and plausible impact

Run

ollama run erukude/vulnerability-researcher:35b

Example Prompt

Review this finding.

Package: example-lib
Version: 1.2.3
Finding: ...
Source: ...
Sink: ...
Reachability: ...
Guards: ...
Impact: ...
Code evidence: ...

Output

Returns JSON:

{
  "verdict": "inconclusive",
  "reason": "One to three concise sentences explaining the decision.",
  "code_evidence": [
    "Specific code fact used for the decision."
  ],
  "evidence_gaps": [
    "Missing fact needed to make a stronger decision."
  ],
  "needs_human_review": true
}

Model Details

  • Base: qwen3.5:35b
  • Fine-tune: LoRA adapter
  • Temperature: 0.2
  • Top-p: 0.95
  • Top-k: 20
  • Output: valid JSON only
  • License: Apache License 2.0

Developer

Created and maintained by Sai Teja Erukude.

Note

Built for defensive security research and responsible vulnerability review. When evidence is weak or ambiguous, the model is designed to return inconclusive.