Replies (1)

• @IngaLovinde@embracing.space 2026-04-02 13:15

  @aredridel and that's one of the reasons why we have a web of trust of some kind, and changes by first-time contributors deserve extra scrutiny, and nobody would accept a huge new feature or a huge refactoring from an unknown first-time contributor. And still most of the time one can expect that contributors, even the first-time ones, are acting in good faith and can be reviewed in good faith as collaborative contributors, not as adversaries who purposefully try to slip a vulnerability past code review, purposefully writing it in such a way that it looks plausibly like benign code. With LLM-generated code, code reviews should treat it as written by an adversary _every_ time. And reviewing code written by an adversary consumes much much more effort than reviewing code written by collaborator in good faith... and why would one even spend any effort on reviewing code written by adversary, when discarding that code and closing the MR is an option?

  Open ##2002859