@zzzxd
You really think letting AI spit out code without scanning it first is safe?
I’ve seen too many “harmless” dependencies turn into attack vectors — SolarWinds wasn’t fiction, it was a warning.
If you’re pasting Copilot’s output straight into prod without SAST or CodeQL, you’re not shipping features — you’re shipping vulnerabilities with comments.
Permissions don’t matter if the code itself is compromised before it even hits your repo.
0 reply
0 recast
0 reaction