[sofixa]

> Really unfortunate. I don't understand why there's such a lack of response on the Cursor side.

It's hard to vibe code security.

[koolba]

Is it though? Cause you can have an agent analyze the reports to filter out the wheat from the chaff.

[thayne]

I suspect that is exactly what cursor did, and the agent (incorrectly) categorized this as chaff.

[iainmerrick]

Ideally, they’ll be able to look back through the logs and find the original analysis from when the bug was submitted, figure out why it was incorrectly filtered, and use that to improve their automation.

The general idea of a few layers of automated triage by increasingly powerful LLMs, before finally escalating to a human engineer, seems like a reasonable way to handle a deluge of submissions. It just has to be implemented well and continuously calibrated.

[petesergeant]

> It's hard to vibe code security.

Conversely, running human or LLM-generated code through multiple LLMs to look for security holes is a fantastic way to increase security.