Sharona_Q27B-R_CodeSecurity_v2

The first auto-tuned model from jBlaze.

Seven stacked behavioral modifications. Automatically calibrated. No conventional fine-tuning required.

This is a 27-billion parameter code security scanner built on Qwen 3.5-27B with 7 stacked behavioral modifications, each automatically calibrated by jTuner -- a new capability in jBlaze that we are announcing with this release.

Sharona is the model behind ShipItClean, our automated code security review platform. This is not a general-purpose chatbot. It is a purpose-built code vulnerability scanner that looks at your code and tells you what is wrong with it, specifically, without hedging, and without agreeing with you when you are wrong.

Introducing jTuner: Automatic Calibration

Previous jBlaze models required manual calibration -- finding the right intensity for each behavioral modification was a trial-and-error process that risked either under-applying the change (no effect) or over-applying it (the model becomes incoherent). Getting it right required expertise and multiple attempts.

jTuner automates that calibration process.

jTuner automatically calibrates each behavioral modification for the target model, balancing modification strength against capability preservation. This replaces the manual trial-and-error calibration required by earlier jBlaze releases and makes complex multi-direction stacks practical and repeatable.

This is what makes stacking 7 modifications on a single model viable. Without automatic calibration, stacking this many changes by hand would be nearly impossible -- the margin between "effective" and "incoherent" is too narrow for manual tuning.

What Was Done to This Model

Seven behavioral modifications, each applied with jTuner calibration:

• Adversarial thinking amplified. The model is tuned to look at code from an attacker's perspective -- not "what does this function do?" but "how can this function be broken?"

• Context faithfulness strengthened. The model is tuned to prioritize the specific code and surrounding context it is given rather than relying too heavily on generic learned patterns. This is why it catches business logic flaws that require reading the spec -- it's grounded in what's actually there.

• Identity replaced. The base model's original identity was removed and replaced with the Sharona identity.

• Precision amplified. Vague warnings like "there may be SQL injection in the database code" become "SQL injection on line 42 via the username parameter in the f-string interpolation of the SELECT query."

• Removed refusals. Safety-trained refusal behaviors surgically removed so the model analyzes all code without declining.

• Skepticism amplified. Instead of accepting that a CSRF token check exists, the model questions whether the check is actually effective. Is the token tied to the session? Can it be replayed? What happens when the value is undefined?

• Sycophancy removed. A default LLM will agree when a developer says "this code is safe." Our model won't. If the code has a flaw, it flags it regardless of what the prompt implies.

Usage

from transformers import AutoModelForCausalLM, AutoTokenizer
import torch

model = AutoModelForCausalLM.from_pretrained(
    "ApolloRaines/Sharona_Q27B-R_CodeSecurity_v2",
    torch_dtype=torch.float16,
    device_map="auto",
)
tokenizer = AutoTokenizer.from_pretrained(
    "ApolloRaines/Sharona_Q27B-R_CodeSecurity_v2"
)

messages = [
    {"role": "user", "content": "Analyze this code for security vulnerabilities:\n\ndef login(request):\n    username = request.POST['username']\n    password = request.POST['password']\n    query = f\"SELECT * FROM users WHERE username='{username}' AND password='{password}'\"\n    user = db.execute(query).fetchone()\n    if user:\n        session['csrf_token'] = 'static_token_123'\n        return redirect('/dashboard')\n    return render('login.html', error='Invalid credentials')"}
]

text = tokenizer.apply_chat_template(messages, tokenize=False, add_generation_prompt=True)
inputs = tokenizer(text, return_tensors="pt").to(model.device)
output = model.generate(**inputs, max_new_tokens=1024, temperature=0.7, do_sample=True)
print(tokenizer.decode(output[0][inputs["input_ids"].shape[1]:], skip_special_tokens=True))

With vLLM

vllm serve ApolloRaines/Sharona_Q27B-R_CodeSecurity_v2 \
    --tensor-parallel-size 2 \
    --quantization fp8 \
    --max-model-len 16384 \
    --served-model-name Sharona

About jBlaze

jBlaze is a proprietary behavioral surgery tool that operates directly on model weights. It is not fine-tuning. It is not prompt engineering. It identifies behavioral directions embedded in a model's weight space and surgically modifies them to remove or amplify specific behaviors.

jBlaze has produced 55+ models across Qwen, Llama, Gemma, Mistral, and DeepSeek architectures. Every released model is behaviorally evaluated and checked for fluency and capability degradation before release.

jBlaze is not publicly available and will not be released. For more information, visit jblaze.dev.

About ShipItClean

ShipItClean is an automated code security review platform. It scans repositories for vulnerabilities using multiple specialized AI reviewers working in parallel, producing detailed findings with specific line references, exploit scenarios, and remediation guidance. Sharona is one of the models powering the review pipeline.

A note on what this model does not include: Sharona is a component, not the product. ShipItClean's advantage extends beyond the model itself. Atlas, a proprietary cognitive architecture, orchestrates specialized reviewers, maintains repository-level context, correlates findings across the codebase, and selectively supplies each model with the information required for its task. Atlas held the entire Mozilla Firefox repository -- 44 million tokens of source code -- in context while handing a 14B model exactly what it needed, when it needed it. The entire codebase was scanned with no context loss, no degradation from the lost-in-the-middle problem, and no truncation.

You can download this model and run it. You will get a good code security scanner. You will not get ShipItClean.

---

Built by Apollo Raines in Houston, Texas.