AI policy for vulnerabilities ?

[Simon Michael]

Say someone finds a security vulnerability, and a fix, with the help of AI.

If you're a hledger 1 user, trying to avoid AI: would you rather

A. have the (very small) security fix backported promptly; or

B. wait for some longer period until someone makes a similar but "blind" fix by hand ?

[Henning Thielemann]

Can this question be answered in a general way? I mean, when you hesitate
to easily accept AI-assisted pull requests it is certainly because no-one
knows whether it as an actual vulnerability and whether it is an actual
fix. It could also be a non-vulnerability and the actual vulnerability is
introduced by the supposed fix. I am afraid we have to double check in any
case.

[Simon Michael]

In this alas not-so-hypothetical case, it's a XSS vulnerability, fairly severe (in theory at least), such that I hesitate to mention it.

I saw the proposed code changes, briefly. And I researched the issue and general approach more. The fix is small (half a dozen lines), easy to understand, and looks obviously correct to me.

So my hesitation to accept it is only in the hledger 1.x series, because we advertise "no AI" there. hledger 1 is the refuge for hledger users who are trying to avoid any AI-assisted work. So partly I'm exploring how to handle similar cases in future.

I could try to recreate the fix without looking again, mimicking "clean room" style. But there's a good chance I'd make a mistake or require fixups. And to be honest, I'd rather spend that time on other things.

Or, if people are really is keen to tackle it (right away), I could point them to the bug.

If a human fixes it without looking at the AI-proposed fix, we get to keep the simple "100% AI free" story about the hledger1 branch. Which seems desirable. But, ultimately it's only a story; who can say the dev didn't check their work with AI etc.

[Simon Michael]

> we advertise "no AI" there

To be more precise - here's what we currently advertise:

"hledger 1.x (2007..2025) was developed without AI assistance. New commits intended for the legacy hledger1 branch may not use AI."

[Chunhui Ouyang]

I wouldn't say AI is a bad thing, but it's definitely not a substitute
for human choice. It merely provides a basis for human engineers to make
technical decisions. Therefore, if someone uses "vibe coding" as an
excuse to evade the legal obligations of human engineers, that's
completely unprofessional. If a PR is completely copied and integrated
without a clear, systematic, and trustworthy review mechanism and the
technical operation of human engineers, then the code has serious
security and logical risks. This is because AI is merely copying code
from the internet and cannot replace human engineers in bearing legal
responsibility. Therefore, this code needs to be reviewed with stricter
standards and ultimately endorsed by a human engineer for their
implementation (or implementations that partially reference the internet
or AI).

[Arthur Cinader]

The commit was not "intended for the legacy hledger1 branch." 

I discovered the problem while reviewing an hledger2 PR: https://github.com/simonmichael/hledger/pull/2671. 

I had a hunch and created a client-side test suite.

In this case, with this fix, backporting to cover a reproducible exposure should be an easy decision given the distribution and use of hledger.

[Simon Michael]

On Mon, Aug 24, 2026, at 16:08, Arthur Cinader wrote:

The commit was not "intended for the legacy hledger1 branch." 

A lawyerly observation! Sustained !   😆

[Arthur Cinader]

Now that we have some practical experience, I propose amending the policy to allow selective backporting of security fixes, subject to maintainer judgment. Make it explicit and maintain transparency.

[Simon Michael]

On Mon, Aug 24, 2026, at 16:59, Arthur Cinader wrote:

Now that we have some practical experience, I propose amending the policy to allow selective backporting of security fixes, subject to maintainer judgment. Make it explicit and maintain transparency.

That's what I figured, too. I have added the exception to https://hledger.org/AI.html#rules-of-engagement rule 2. It's a pity to complicate the rule, but I'm hoping it won't be needed again.