@mcc @sackofbones @reflex

The important thing is the project commit to an intent; that gives you a "safe" zone you can stand in and clear out slop from there.

I agree, but only to the level the project's maintainer(s) can and want to support. For example, I have absolutely zero time (or desire) to audit each and every commit from each and every third-party vendored code in FreeBSD. It's already difficult tracking FreeBSD src on a commit-by-commit basis. (Thanks to the FreeBSD folks for providing per-commit emails!)

(Sorry to go on a tangent parenthetical, but that last paragraph touches on something I've learned as the long-term maintainer of a FOSS project: we, as a community, need to be careful about placing expectations on how random other people on the internet use their time. Only my family, my employer(s), and I can set my daily schedule or priorities.)

So, coming from the aspect of the futility of the lack of time: the intent (for me and the HardenedBSD project specifically) to be an "AI safe zone" is there--but the ability is not 100%. My time is much better spent implementing exploit mitigations and doing other R&D than reading git commit logs.

If someone in the community wanted to take that effort on, by all means--and that's part of what makes open source great! I myself can't.