Refresh Gemini validation-engine model defaults (v2.7.1) - #3
Merged
Conversation
Track Google's current Gemini lineup for the two-tier AI validation engine — default model IDs only, no change to engine logic (all stay env-overridable). - Tier-1 pre-filter default → gemini-3.5-flash-lite (was gemini-3.1-flash-lite): fastest / most cost-effective 3.5-class model for the high-volume noise-rejection tier. - Tier-2 deep-validation default → gemini-3.6-flash (was gemini-3.5-flash): stronger reasoning workhorse for confirming genuine high-severity exposures. - Document the security-specialised 3.5 Flash Cyber model as a Tier-2 override in .env.example for security-focused deployments. Version bumped to 2.7.1 (single-sourced from pyproject; report + frontend strings updated). Suite stays green (270 passed), ruff clean. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01V6XK23ZKmYtCovRte9a73E
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Refreshes the two-tier Gemini AI-validation engine to track Google's current lineup. Default model IDs only — no change to engine logic. Both tiers remain fully env-overridable, and the legacy single-model
GEMINI_MODELoverride is still honoured.gemini-3.1-flash-litegemini-3.5-flash-litegemini-3.5-flashgemini-3.6-flashBoth new IDs were verified callable against a live API key (via the
v1beta/modelslist) before selection.Also included:
.env.example: pointGEMINI_TIER2_MODELat the security-specialisedgemini-3.5-flash-cybermodel (tuned to reason about software vulnerabilities) once a key can call it — a strong fit for the deep secret-validation tier. Left as a commented opt-in rather than a default, since it is not yet GA on all keys and a hardcoded unavailable model would 404 every scan.CHANGELOGentry updated to the new IDs..env.exampletip: the one-liner to list the exact model IDs a given key can call, so operators pick valid overrides instead of guessing.pyproject.toml;report.pyfallback +frontendstrings follow).Type of change
Checklist
ruff check backend/passespytestpasses (added/updated tests for the change) — 270 passed, no logic change so no new tests requiredseverity,cwe, andremediation— n/a (no new detectors)🤖 Generated with Claude Code
https://claude.ai/code/session_01V6XK23ZKmYtCovRte9a73E
Generated by Claude Code