Comment by mattstir
9 hours ago
But then an attacker marks their malicious release as a critical security update. It's really messy unfortunately.
9 hours ago
But then an attacker marks their malicious release as a critical security update. It's really messy unfortunately.
We need something external that actually checks to see if source code matches built artifacts, and also possibly something Llm based that checks to see if you’re making checked in code vulnerable or directly adding something malicious.