LLMs can now discover suspicious code paths and propose fixes before maintainers have reproduced the bug.
This session follows the complete vulnerability lifecycle from an open-source Java maintainer’s perspective.
Anthony will triage an AI-discovered flaw, reproduce it in CI, assess its impact, and use AI critically to develop and validate a secure patch.
He will then release the fix and trace how the disclosure moves through GitHub Security Advisories, CVE, and OSV before reaching tools such as Dependabot and Snyk.
Along the way, attendees will see why scanners may disagree, where advisory data can stall, and which decisions should never be delegated blindly to an LLM.
The audience will leave understanding the whole CV lifecycle, and how patterns for automating dependency monitoring, patch validation, and disclosure work behind the curtains.