Replying to @GrapheneOS@grapheneos.social
Winnowing (reviewing) the LLM chaff to find the real vuln signals has been a problem for our projects. Winnowing is the majority of the work; maybe 0.5% to 1% turn out to be real.
External reporters who use LLMs as a start, but then winnow themselves to report actual verified vulns, are great. 😉
The ratio of $60M of tokens (subsidized pre-IPO) doing less precise work than $10M of expert code review... is probably not sustainable.