Keep the deadline, and have platforms scan and patch by default

1 reason2 sources

What this position proposes

Platforms that host or test open-source code, like GitHub and Google's OSS-Fuzz, scan every public project automatically and send each finding to the maintainers together with a tested patch.

Reasons

1.
Platforms already do part of this: since July 2026 OSS-Fuzz attaches tested AI patches to memory-safety bugs it finds in C/C++ projects, and GitHub suggests fixes for code scanning alerts on public repositories for free.^[1]^[2]
1. Source 1: Google Security Blog: From finding to fixing, reducing maintainer burden with automated patches (July 29, 2026) · blog.googleOpen original
2. Source 2: GitHub Changelog: Copilot Autofix for CodeQL code scanning alerts free on all public repositories (Sept 18, 2024) · github.blogOpen original

Anyone can add a reason, an objection or a source here. You create a free account when you publish. Already have one? Sign in.

Reasoned.

The strongest case for each side of contested questions, with sources. Found a mistake? Tell us.

All topics Propose a topic Contributors World map About Guidelines Contact