LLMs for security review is a great use of the tool. Let it give you bugs and security issues ranked by severity and suggestions on how to fix them, then it’s up to you to implement if you want to have a layer of isolation.

An AI security tool can’t substitute for a real security audit. Especially if you don’t have the necessary know-how to verify the outcome. If you don’t have extensive experience performing manual security code audits, don’t even bother. You might just as well release it with a disclaimer that it hasnt been vetted and leave it up to whoever want to test it to review it.

If you do opt for a scan, please disclose it properly. Many will never consider code that has been touched by an LLM in any shape or form, but it’s better to be honest about it.

Finally, if you pay the frontier labs for their models you are supporting their business practices including training models on stolen data, the destruction of the environment and further inflation of the AI bubble. A local model is not much better, all things considered, but at least Scam Altman and Wario Amodei won’t benefit.

For my 2c, I think it’s a good idea. If you don’t, and it gets any use, attackers or contributors will.

It’s kind of a lose/lose tho. The target audience is very anti-LLM, so some people will hate it. It’s that or leave low-hanging fruit bugs in there.

Either way, make sure to include an AI disclosure and explanation front-and-center. If I see a new project posted any more, I immediately write it off as low effort, vibe-coded slop until I have a reason to think otherwise. But using LLMs is not necessarily equivalent to slop imo.

@artifex I'd treat an AI scan as one pass rather than a verdict. Before publishing, also check your git history for old API keys or tokens, since a secret deleted three commits ago is still public once the repo is. Starting a fresh repo from the current tree is a simple way around that.

Honestly not everyone will agree, but personally I can’t see any flaw in using AI to read through your code and point out security flaws. It’s going to happen regardless of whether you initiate it. It’s not like us sys admins are going “well I’m not going to patch the dirtyfrag vulnerability because it was discovered with AI”. I’d say knowing if AI can find a vulnerability in your code, is just a requirement right now.