Post

If you maintain an open-source project and don't accept AI-assisted vulnerability reports, please say so openly and publicly in your SECURITY.txt, website, or repo. Doubly so if you pride yourself on being "security first".

15/10/26, 9:52 am1 repost53 likes

LambdaDuck

@anka213.bsky.social

it is however very reasonable to expect a human to at least have confirmed on their own that the issue is real and preferably to also understand the vulnerability (the ai should be able to explain it in such a way that the operator understands it)

sairyon

@sairyon.bsky.social

You have to have in mind that many people have been rendered jobless, maybe even homeless by AI and they don't actually beam enthusiasm about AI. Just like "all rights reserved" is implied on repositories without license, it is equally safe to assume AI-generated contributions are unwelcome.

Flo 🔶

@faz.ms

Just asking people to express that lack of enthusiasm publicly. So I can save the hours hardening their project and know beforehand if I can in good conscience recommend it to clients

AJC

@acjc.mu.social

Is it worth asking different models to scan a repo for security issues? Like, I use deepseek-v4.1-flash to code one repo, is it a good idea to use glm-5.3-flash to scan that repo every so often?