Post

Made a new blurg post about AI + OSS security. I was going to just complain on here, but I figured a short blog post would be better for my complaining 😂 tenderlovemaking.com/2026/05/06/r...

tenderlovemaking.comRails Security, AI, and IBBFor quite a few years the Rails project has been working with the Internet Bug Bounty (IBB). The IBB is an organization that awarded cash to security researchers that reported issues to OSS projects p...

6/5/26, 5:46 pm12 reposts43 likes

Alex Snaps

@alex.wcgw.dev

6 May

As Joe would have possibly put it (again): the mess we’re in: fosdem.org/2026/schedul...

fosdem.orgFOSDEM 2026 - Open Source Security in spite of AI

Robby Russell

@robbyonrails.com

6 May

This has been a big issue for Oh My Zsh, too. We're fielding a bunch of nonsense AI-generated stuff that we have to spend time coordinating between ourselves if it's worth evaluating/responding/etc.

Joshua Wood

@joshuawood.net

8 May

Are you guys doing any AI vulnerability scanning of your own like RubyGems is? blog.rubygems.org/2026/04/29/s...

blog.rubygems.orgScaling Ruby's defenses with AIOn April 23rd, we submitted a vulnerability report to the Nokogiri maintainers. It was the first one our team has filed using AI-assisted scanning. The maintainers accepted the report and published...

polstishka.bsky.social

@polstishka.bsky.social

7 May

Maybe accept new reports only from people who have already been rewarded in the past.