David Ondrej discusses reported security incidents involving PHP, digital certificates and a hosting provider. He presents them as motivation for more frequent code and dependency review; his incident characterizations and predictions are his own assessments.
Ondrej demonstrates scheduled agent workflows that inspect different parts of a codebaseAI-assisted code review uses AI to inspect software changes for defects, risks, standards, missing tests, and opportunities for improvement while human reviewers retain responsibility., watch for supply-chain issuesSoftware supply chain security protects the dependencies, tools and delivery processes used to build and distribute software, including AI applications. and flag findings for review. He describes using stronger models for critical checks and lighter models for some monitoring tasks.
He outlines a second-model reviewEvaluation is the systematic assessment of a system's behaviour or results against explicit criteria. step intended to filter weak findings and discusses choosing whether a proposed fix waits for human approvalHuman judgment in AI is the accountable interpretation and decision-making people contribute when setting goals, evaluating evidence, and managing consequences.. The demonstration uses his own product, and the episode does not establish that automated reviews alone make software secure.
Watch on YouTube
