The wave of vulnerabilities from the last week and the "Red Team" stuff makes one feel that vulnerability disclosures are probably going to get messier before they get clean (if they ever do). People turning their llm on whatever project and then posting about it on social media seems like a very leaky way of alerting maintainers.
In that vein:
Vulnerability Spoiler AlertVulnerability Spoiler Alert
A monitoring hub that watches popular open-source repositories and uses AI to detect when commits are patching security vulnerabilities - often before a CVE is even assigned. Findings are published to a retro-themed website with an RSS feed.
This project is an example usage of spaceraccoon/vulnerability-spoiler-alert-action by Eugene Lim (@spaceraccoon).
The original concept and research is documented in the blog post Discovering Negative Days: LLM Workflows for Vulnerability Research, which explores using LLMs to identify security patches before CVEs are assigned - turning the typical "zero-day" into a "negative-day" by catching vulnerabilities in the window between the fix landing and public disclosure.
Tough times for people who build things.
I once got accused by a person that disclosed a vuln to me that I didn't hide something well enough by calling it a bug. I thought it was perfectly fine to call it a bug, because then I can tell people to please upgrade to get rid of a bug, rather than wait for someone else to find it.
Instead, per their opinion, I should have reworked all the surrounding code, bring in new features and what not. All within the 5-day deadline until they would report to the public.
There is no silver bullet. Only bullets. And people getting hit by them. It's not a great time to depend on software for important things right now.