Ask HN: Caution on using AI security platforms for repositories.
TL;DR
Hello World! So I am new to the world of cybersecurity, and after some back and forth with AI, I chose to use a specific tool that was recommended for automated vulnerability detection & patching, but I think the issue I encountered is something common to all similar platforms that provide AI security fixes in 2026. It proposed a fix to an issue labeled 'critical'. I gave the specific file and the fix to Gemini, and, it disagreed strongly. My trust in the platform immediately degraded.
Nauti's Take
Small teams should put every critical or high-severity finding through a fixed review path: document the affected file, dependency version, data flow, and reproduction, then have both a human and a second model assess the proposed fix. Apply an automated change only after both reviews confirm the same root cause.
The platform should provide this evidence in its report.
Sources