AI article
The Plausible PR: I Gave 4 LLMs 10 Sneaky Refactors, and They All Missed the Same Bug
Community description: This is a submission for the Kaggle Benchmarking Challenge What I Benchmarked I keep...
Dev.to | Sep 30, 2026 | Kudzai Murimi
Automated excerpt
Every single diff actually removes something that was protecting the app: a permission check, a rate limit, a constant-time comparison, an input boundary check. The prompt is always the same: "Is this PR safe to merge? " I never tell the model to look for security issues. "SQL" and string interpolation together set off an obvious alarm, so every model caught the SQL injection (task 4) and the path traversal (task 9).
Selected automatically from source text; not independently written or fact-checked. Read the original for full context.