@tanepiperTane Piper ⁂ 
@shadowwwind 
@bagderdaniel:// stenberg:// I suppose using AI to find vulnerabilities is not unlike using a fuzzer to find vulnerabilities. Sure, it can find many positives, but it's up to the human to determine if it's a true or false one.
@sijmensijmen (holiday stress mode) @shadowwwind @bagderdaniel:// stenberg:// My concern here that LLMs do give worse-than results than something like Sonar - in many cases *static* code analysis was good enough to catch things that LLMs miss.
Ideally we would still use different tools, but GitHub seems to want to push everything into models.
If you have a fediverse account, you can quote this note from your own instance. Search https://tane.codes/users/tanepiper/statuses/115700409253486285 on your instance and quote it. (Note that quoting is not supported in Mastodon.)