This was my first thought after they disallowed LLM contributions.
They may not use AI to check for vulnerabilities but attackers are going to which puts themselves at the disadvantage.
This was my first thought after they disallowed LLM contributions.
They may not use AI to check for vulnerabilities but attackers are going to which puts themselves at the disadvantage.
They did not disallow LLM contributions, and they definitely didn't disallow using LLMs to research security vulnerabilities. They only disallowed projects that are majority LLM-written.
https://codeberg.org/Codeberg/org/commit/71149c7fc95ccfeae36...
That is about Codeberg, not Forgejo.
Forgejo disallows LLM contributions, including using a "general AI" (they include LLMs under "general AI") for reviews[0]:
> 5. Using general AI for review is forbidden. If the change contains changes to the UX it has to be approved by a human reviewer.
[0] https://codeberg.org/forgejo/governance/src/branch/main/AIAg...
Ah sorry, didn't realize they had their own policy. This is a little stronger, but you can certainly still use an LLM to search for vulnerabilities, you would just need to write fixes yourself and mention if you used an LLM for assistance.
The rule you quoted is about code reviews, they don't want you using an LLM to write reviews or leave comments.
This is a pretty poorly written policy to be honest, so I understand if you interpret it to mean "no LLMs in any capacity", but I think if that's what they meant they would have said that. In fact they explicitly allow content "made with the help of AI", you just have to disclose it.
Their definition of vibe coding is pretty whacky.
>Vibe coding is the practice where AI creates a code change (feature, bug fix, tests, refactor) with a human that describes what needs to be implemented.
So if you let an AI prompt another AI without human input, that's not vibe coding? Meanwhile if you prompt the model with pseudo code you've written or code written in another programming language to translate into the target language, that's vibe coding?
>It is not allowed to use AI in an autonomous-looking way to contribute in Forgejo.
They used the word "in", meaning it could refer to organizational membership, their repo or theoretically any instance of Forgejo, including self hosted ones. They failed to specify what part of Forgejo or the definition of Forgejo they meant.
Overall this is a pretty poorly written document and when you think about it, it doesn't really matter how poorly written it is when they are basically 100% against AI.
> Forgejo disallows LLM contributions
You're misreading the rule.
>> 5. Using general AI for review is forbidden.
The second sentence makes it even clearer, as it would have been unnecessary under a blanket ban scenario
>> ... If the change contains changes to the UX it has to be approved by a human reviewer.
This looks unambiguous to me:
Using AI to find a vulnerability is not a work of authorship. Using the AI generated text as your bug report would be, but if you use AI to find a bug, then write up a report yourself, I think that would be fine.
>If the change contains changes to the UX it has to be approved by a human reviewer.
Would that not imply that a change that does not effect the UX does not have to be approved by a human reviewer? Otherwise, why specifically call out "changes to the UX" and not say "all changes"?
Was this discovered by AI? Is all AI code 100% free of bugs?
You are implying that just by allowing LLM contributions your product is free of bugs, and the LLM won't introduce new bugs. Of course, if the LLM introduces bugs, the solution is to add another layer of LLM looking for bugs, ad infinitum.
Another post from today from Shopify, praising LLM to code their frontend, also stated that their LLM generated code is not ready to deploy, and needs to be reviewed:
> It’s tempting to just point an LLM to the React Native codebase and try to one-shot the same features in native, but it doesn’t work. Even if you ask it to gather as much information as it can up front, freeze that into specs, task files, and then implement it, you end up with a huge amount of unmaintainable code that can’t be shipped. [...] each [build] must prove its behavior with tests, match the running app in a visual review, survive two adversarial code reviewers, and get a human's nod before it's committed and the next one starts.
> You are implying that just by allowing LLM contributions your product is free of bugs
That... is not the implication of the comment you're replying to.
You don't need to make it all fundamentalist.
> They may not use AI to *check for vulnerabilities*
you didn't read the comment, did you?
I really disagree with their acceptable usage policy, but you can't say it with certainity that LLM contributions would be a fix for this. They generate so much noise (as the primary incentive behind an independent LLM scan is often cheap contributor brownie points for your CV) that it also could lead to bogus PRs being approved or helpful PRs being lost in the noise.
Why can't you use an LLM to find vulnerabilities and then hand-code the fix? You don't even have to clean-room implement it; let the LLM write the code, and then reimplement, doing what you can to de-LLM-ify it.
You can. People on Codeberg use LLMs. They are just against spam of low quality projects generated with LLMs.
That is actually entirely not what they were saying at the time of the vote and its aftermath. At all.
Go back and read the threads. On this forum, or on mastodon, or on the vote. It was pretty vociferously ... shall we say ... "principled"
It was never stated to be about "low quality" but about use in "large part" or "majority", and when pressed people refused to define what that meant, and in fact got angry and defensive and said things like "you'll know if you've crossed the line" and "stop trying to force consent" and similar pearls of wisdom.
The post-facto rationalization did in fact leave them room to judge "quality" on a purely subjective basis. I didn't stick around to find out how that would shake out.
Do you expect it to be enforced by a machine? Why would you need a precise definition of "majority"?
You can, though some people are going to be annoyed by it and just publish a zero day out of spite.
Disallowing LLM contributions doesn't disqualify the use of LLMs to identify vulnerabilities.
Using LLMs for automated security audit looks like it could fall under the definition of "vibe coding" or "agent mode", which is strictly forbidden
>6. It is not allowed to use AI in an autonomous-looking way to contribute in Forgejo. This also applies when someone engages in 'vibe coding' or uses so-called 'agent mode'.