On Tue, 03 Nov 2026, Michael Malis <[email protected]> wrote: > I know the mailing lists have been hit with a flood of automated bug > reports lately and > the last thing I want to do is create more headaches for the team. > Over the past few > months, I've been building a suite of tools for finding bugs. That > work has surfaced > over 1000 previously unreported bugs ranging from crashes, to > corruption, to MVCC > violations. I've included three of the bugs so you can get a sense of > some of the findings.
I did the same thing, and I am facing basically the same issue. As Alvaro already mentioned, my first concern was security issues - separating the bulk of it is relatively easy with LLMs, but even that requires careful manual review as even when you tell them the criteria used by the security team, they still misclassify issues. In my case, around ~5% of all findings were security-suspect issues initially, but after reading them manually I only considered half of them as such based on the postgres guidelines, so the rest of them could be declassified. Unfortunately the other direction is also true: I have several examples where an LLM identified an issue as not-security, but after looking into a bit more and writing a patch for it, I realized that it is security related. And that second part is the main reason why so far I only published my open-issue list with a limited set of people instead of somewhere public and posting a link to it to hackers to parallelize the work, and then we are slowly sending patches about them to the list one-by-one.
