David Kim

General 12 min

David Kim • 2 days ago

Can a CI Gate Detect AI-Generated Code in a Pull Request?

A DevSecOps lead's field notes on putting AI-generated code detection inside a real CI pipeline: what the detector actually measures, which files produce false positives on day one, and why the gate should warn on pull requests but only block on release. Includes the config we run and the numbers we got.

Read

General 12 min

David Kim • 1 week ago

A Triage Framework for AI Code Detection in Student Work

An AI detection score is a signal, not a verdict. This is the four-stage triage I borrowed from a fintech incident pipeline to decide which alerts deserve a conversation, which deserve a case file, and which deserve to be closed.

Read

General 10 min

David Kim • 2 weeks ago

Token and AST Normalization in Code Similarity Detection

Line diffing under-reports copied code and over-reports similar-looking code. Here's what token normalization and AST fingerprinting actually compare, where each one breaks, and how to wire both into a CI pipeline or an academic submission workflow.

Read

General 7 min

David Kim • 3 weeks ago

How Open Source License Scanning Evolved From SPDX to Policy Gates

License scanning went from hand-checking COPYING files to SPDX metadata and policy-as-code gates. This piece traces that arc, shows which gaps still let copied code slip through, and explains how to pair license scans with source matching for audit-grade evidence.

Read

General 11 min

David Kim • 4 weeks ago

Wiring AI Code Detection Into GitLab Merge Request Pipelines

A DevSecOps lead's field notes on running AI-generated code detection as a merge request gate in GitLab CI, with the exact YAML, thresholds, and audit trail decisions that survived a fintech rollout.

Read

General 8 min

David Kim • 1 month ago

How a Fintech DevSecOps Lead Runs Contractor Code Plagiarism Detection

Most vendor code passes unit tests and static analysis. It fails provenance checks. This is the exact merge gate I run in a fintech CI pipeline: Codequiry's plagiarism and AI scans wired into GitHub Actions, with thresholds, evidence review, and a failure policy.

Read

General 4 min

David Kim • 2 months ago

How Web Code Plagiarism Detection Actually Works

A technical deep-dive into how modern plagiarism checkers spot code lifted from the open web. We walk through crawling, token-based fingerprinting, and matching algorithms that survive renaming and refactoring, with real examples and a look at where tools like MOSS fall short.

Read

General 12 min

David Kim • 2 months ago

MOSS, JPlag, and AI Detectors Across 1,200 Obfuscated Submissions

A deep-dive comparison of MOSS, JPlag, Dolos, and hybrid detectors on deliberately obfuscated student Java code. Token-based algorithms catch most refactoring, but AI-generated obfuscation is changing the game — and combining similarity checks with AI detection is the only reliable way to stay ahead.

Read

General 11 min

David Kim • 2 months ago

Three Semesters of Detecting Collusion in CS1 Without Burnout

When you teach 400 students each semester, “check the MOSS output” stops being a casual Friday task and becomes a logistical nightmare. After three iterations of the same introductory Java course, I’ve settled on a repeatable workflow that catches collusion without sacrificing evenings, weekends, or relationships with honest students. Here’s exactly how the pipeline works, what tools sit where, and where Codequiry finally closed the gap I was losing sleep over.

Read

General 10 min

David Kim • 2 months ago

At What Renaming Threshold Do Token-Based Detectors Fail?

Most CS instructors trust MOSS to catch code copying — but how much renaming actually breaks it? This step-by-step guide shows you how to run a controlled experiment, measure the exact threshold where token-based similarity collapses, and see why a multi-stage engine that combines tokens with AST fingerprinting catches what MOSS misses.

Read

Case Studies 2 min

David Kim • 3 months ago

One Community College's Web Code Plagiarism Strategy

When intro programming students at a mid-sized community college were copying entire code snippets from Stack Overflow and GitHub, the department needed a scalable detection solution. By integrating Codequiry’s web-source matching into their grading pipeline, they reduced surface-level copy-paste incidents by 40% in a single semester while cutting manual review time by 60%.

Read

General 8 min

David Kim • 4 months ago

How Winnowing Fingerprints Resist Variable Renaming

Winnowing fingerprinting is a powerful technique for detecting code plagiarism that survives variable renaming, refactoring, and cosmetic changes. This case study examines how the algorithm works, where it succeeds, and where it falls short compared to AST-based approaches.

Read