CIRCLE WITH A DOT

@varx I have basically the same strategy. Except I also occasionally add the :old-man-yells-at-claude: emoji below such a thing (esp. if coming from someone higher up).

@afeinman I've gotten a bunch of these, all different. The goofiness level varies. I reckon they came up with a prompt, generated a few, said "looks good", and let 'er rip. Probably generating a new one every few days without actually reviewing it.My favorite subject line so far is "8RD ATTEMPT: Payment Declined — Inbox Suspension Active".

Before reaching for an LLM for finding vulnerabilities in your own project, you should probably still be:- Testing- Linting- Running other existing, algorithmic static analysis tools for security- Fuzzing- Looking at new and existing security bugs and looking for other bugs of the same type *and* findings ways to make each type of bug harder to introduce in the futureWith those already in place, LLMs still don't seem to have a major advantage. I'm curious whether that will change, though.