The number of CVEs GitHub helps open source projects disclose has more than doubled compared to any 30 day period in the past year. Many of these vulnerabilities are being discovered with LLM assistance, and a natural question is "are they slop?" Using the famously uncontroversial CVSS scores, you can see that there are more low severity and high severity scores compared to a year ago. 🤷 It's complicated!

Sources:
- https://cnapulse.org/cna-detail.html?cna=GitHub_M
- https://www.cvedetails.com/cvss-score-charts.php?fromform=1&vendor_id=&product_id=&startdate=2025-01-12&enddate=2025-02-12
- https://www.cvedetails.com/cvss-score-charts.php?fromform=1&vendor_id=&product_id=&startdate=2026-01-12&enddate=2026-02-12

Are you a senior software engineer in need of a break this holiday season? When someone asks you for feedback, roll a d6 and respond:

6: "what problem are you trying to solve?"
5: "where is this written down?"
4: "is this on the critical path?"
3: "you need to add rate limits"
2: "what features can we remove for the proof-of-concept?"
1: "we tried that 5 years ago and it didn't work"