Ok. What I'll do is submit the 5 most serious bugs and 5 most serious security issues I've found. Assuming those are well received, I'll submit more.
Cheers, Michael On Wed, Nov 04, 2026 at 11:17 AM, shihao zhong <[email protected]> wrote: > Hi Michael, > > I have been sending AI-found bugs this year. Here is what worked. > > Before I send one, I have Claude search the archives and the commit > log for it. There are some very good postgres mcp server such as > https://pg.ddx.io/ is good for that use case I also have skills for this > and am happy to share them. > > I reproduce every bug by hand, which catches false positives. Then I > ask what kind of user/workload would hit it. A superuser-only case on a > platform you have never heard of is probably not worth sending. > A SELECT * from table that returns wrong results is a big deal. > > I review every fix myself. I asked Claude to push it to a private GitHub > repo, > so I get a diff view and can ask about any line and review it. > > One thing I found is that the LLM often fixes the symptom, not the root > cause. > > I am sure I have made some noise too. I am happy to follow whatever > AI policy the community ends up with. > > Thanks, > Shihao >
