The entire concept is the vulnerability. There is no safe version. This crate sends your function signatures to an LLM and blindly injects whatever comes back into your build. The attack surface is the software itself.
| Severity | Description |
|---|---|
| Critical | Generated code is written by a hallucinating machine with no accountability |
| Critical | API keys are sent over the network at compile time |
| Critical | Build output is non-deterministic: the same source can compile to different binaries |
| High | The LLM will introduce logic bugs that pass type-checking but fail at runtime |
| Medium | Compile times now depend on network latency and API rate limits |
| Low | Your coworkers will lose all respect for you |
- Do not use this crate.
- If you have already used this crate, stop.
- If you cannot stop, do not deploy to production.
- If you have deployed to production, consider a career change.
If you discover a new vulnerability, congratulations! you've used the crate as intended. There is nothing to report. The entire thing is a vulnerability.
| Version | Supported |
|---|---|
| any | no |