because their js code is so bad and slow that they need the bun performance hacks and optimisations.

Do these hacks make bun less secure than other runtimes? I find it a little hard to believe you can get much more robust and performant than V8 or SpiderMonkey without cutting some corners that notably went uncut by either for all these years.

	▲	msdz an hour ago \| parent \| next [-]
		Bun uses JavaScriptCore, which is Safari’s JS engine, for the actual interpreter portion of its runtime. Which makes the parent comment’s “Bun performance hacks and optimizations” sound a little far-fetched, at least in this scenario I don’t think that’s gonna be the deciding factor. Their vendored JSC is also not touched by this port-rewrite at all whatsoever (still Cpp), so I’m not sure if it’s even possible to hack-improve all that much there.
	▲	jFriedensreich 29 minutes ago \| parent \| prev [-]
		yes, especially compared to deno bun does not have proper isolation or permissions at runtime layer which is why anthropic tries to fix the lack by a mixture of app layer (build into claude code) and os layer (srt) however using runtime permissions would allow much better security if done right.