Hi all, I wanted to raise a process concern around detailed security analysis in public bug records, code reviews, commit messages, and advisories.
I have been using LLM-assisted review across these sources to find real vulnerabilities, and one thing that has become clear is that this material is increasingly useful for finding variants, regressions, and related insecure patterns. Even after a specific bug is fixed, detailed reasoning about exploitability and nearby security sensitive code paths can remain valuable to attackers. I am not arguing against thorough security analysis or useful public advisories. I am suggesting we distinguish between public impact/fix guidance and deeper security analysis that may be better kept in restricted channels. I realize this cuts against some disclosure norms, but I think AI-assisted variant discovery changes the tradeoff enough to merit discussion. Cheers, Tim Confidential communication. No warranties or commitments unless in a signed agreement. If received in error, notify sender and delete. Unauthorized use prohibited.
