
this customer got notified 45 mins after attack, 1.5 hours before announcement of the attack. Generalist coding agent is also a better security reviewer than you! there is basically 0 reason not to have a Review bot enabled for all the things. it’s not just a security thing, it’s for paying attention to all the little stuff (9x% of the time it doesn’t matter, 10-x% of the time it matters a lot, do expected value calc of your time/money saved*) *yes this is a bit of a Pascal’s wager/insurance argument, doesn’t mean it’s wrong