Re: Preferred way to submit a very large batch of bugs?

On Tue, 03 Nov 2026, Michael Malis <malis(at)pgrust(dot)com> wrote:
> I know the mailing lists have been hit with a flood of automated bug
> reports lately and
> the last thing I want to do is create more headaches for the team.
> Over the past few
> months, I've been building a suite of tools for finding bugs. That
> work has surfaced
> over 1000 previously unreported bugs ranging from crashes, to
> corruption, to MVCC
> violations. I've included three of the bugs so you can get a sense of
> some of the findings.

I did the same thing, and I am facing basically the same issue.

As Alvaro already mentioned, my first concern was security issues -
separating the bulk of it is relatively easy with LLMs, but even that
requires careful manual review as even when you tell them the criteria
used by the security team, they still misclassify issues. In my case,
around ~5% of all findings were security-suspect issues initially, but
after reading them manually I only considered half of them as such
based on the postgres guidelines, so the rest of them could be
declassified.

Unfortunately the other direction is also true: I have several
examples where an LLM identified an issue as not-security, but after
looking into a bit more and writing a patch for it, I realized that it
is security related.

And that second part is the main reason why so far I only published my
open-issue list with a limited set of people instead of somewhere
public and posting a link to it to hackers to parallelize the work,
and then we are slowly sending patches about them to the list
one-by-one.