This was my first thought after they disallowed LLM contributions.

They may not use AI to check for vulnerabilities but attackers are going to which puts themselves at the disadvantage.

burkaman 2 hours ago | parent | next [-]

They did not disallow LLM contributions, and they definitely didn't disallow using LLMs to research security vulnerabilities. They only disallowed projects that are majority LLM-written.

https://codeberg.org/Codeberg/org/commit/71149c7fc95ccfeae36...

▲

badsectoracula 2 hours ago | parent [-]

That is about Codeberg, not Forgejo.

Forgejo disallows LLM contributions, including using a "general AI" (they include LLMs under "general AI") for reviews[0]:

> 5. Using general AI for review is forbidden. If the change contains changes to the UX it has to be approved by a human reviewer.

[0] https://codeberg.org/forgejo/governance/src/branch/main/AIAg...

	▲	burkaman an hour ago \| parent \| next [-]
		Ah sorry, didn't realize they had their own policy. This is a little stronger, but you can certainly still use an LLM to search for vulnerabilities, you would just need to write fixes yourself and mention if you used an LLM for assistance. The rule you quoted is about code reviews, they don't want you using an LLM to write reviews or leave comments. This is a pretty poorly written policy to be honest, so I understand if you interpret it to mean "no LLMs in any capacity", but I think if that's what they meant they would have said that. In fact they explicitly allow content "made with the help of AI", you just have to disclose it.
	▲	overfeed an hour ago \| parent \| prev [-]
		> Forgejo disallows LLM contributions You're misreading the rule. >> 5. Using general AI for review is forbidden. The second sentence makes it even clearer, as it would have been unnecessary under a blanket ban scenario >> ... If the change contains changes to the UX it has to be approved by a human reviewer.

▲

titularcomment 3 hours ago | parent | prev | next [-]

I really disagree with their acceptable usage policy, but you can't say it with certainity that LLM contributions would be a fix for this. They generate so much noise (as the primary incentive behind an independent LLM scan is often cheap contributor brownie points for your CV) that it also could lead to bogus PRs being approved or helpful PRs being lost in the noise.

▲

bdcravens 2 hours ago | parent | prev | next [-]

Why can't you use an LLM to find vulnerabilities and then hand-code the fix? You don't even have to clean-room implement it; let the LLM write the code, and then reimplement, doing what you can to de-LLM-ify it.

	▲	omnimus 2 hours ago \| parent [-]
		You can. People on Codeberg use LLMs. They are just against spam of low quality projects generated with LLMs.

▲

otherme123 3 hours ago | parent | prev | next [-]

Was this discovered by AI? Is all AI code 100% free of bugs?

You are implying that just by allowing LLM contributions your product is free of bugs, and the LLM won't introduce new bugs. Of course, if the LLM introduces bugs, the solution is to add another layer of LLM looking for bugs, ad infinitum.

Another post from today from Shopify, praising LLM to code their frontend, also stated that their LLM generated code is not ready to deploy, and needs to be reviewed:

> It’s tempting to just point an LLM to the React Native codebase and try to one-shot the same features in native, but it doesn’t work. Even if you ask it to gather as much information as it can up front, freeze that into specs, task files, and then implement it, you end up with a huge amount of unmaintainable code that can’t be shipped. [...] each [build] must prove its behavior with tests, match the running app in a visual review, survive two adversarial code reviewers, and get a human's nod before it's committed and the next one starts.

	▲	1matin 2 hours ago \| parent [-]
		> They may not use AI to check for vulnerabilities you didn't read the comment, did you?

▲

striking 2 hours ago | parent | prev [-]

Disallowing LLM contributions doesn't disqualify the use of LLMs to identify vulnerabilities.