AI finds vulnerabilities faster than ever these days

Every application or website we build leans on packages and frameworks from third parties. Makes sense, you don't want to reinvent every wheel. But it also means a vulnerability in one of those packages can hit your application or website directly, even if you haven't done anything wrong yourself.

With the rise of advanced AI models, those vulnerabilities are now found and published at breakneck speed. Including by the wrong people.

Why third-party packages are a blind spot

A modern application quickly consists of hundreds of dependencies: direct packages you add yourself, and indirect packages those depend on in turn. You rarely see those deeper layers as a developer, but they run in production regardless.

A vulnerability doesn't need to live in your own code to reach your users. It can be buried three or four layers deep in a package you've never even heard of by name.

AI is speeding up vulnerability discovery

Where finding and documenting a vulnerability in a package used to take days or weeks, AI models now do it in a fraction of the time. That's good news when it's security researchers responsibly reporting it to the maintainer. It's less good news when bad actors use that same speed to find vulnerable applications before a patch exists.

The result: the window between "vulnerability discovered" and "vulnerability actively exploited" keeps shrinking. Waiting for the next scheduled release is no longer an option.

What we do about it: continuous monitoring

That's why everything we build runs monitoring from the day it ships. The moment a vulnerability becomes known in a package or framework we use, we get notified. Even if it's buried deep inside the project.

For the health of the application itself, we use Oh Dear: uptime, performance, SSL certificates, and the overall status of every site and application we deliver, watched around the clock.

Errors that slip through anyway are caught in real time with Bugsink, an open source error tracking tool we self-host on our own European servers. No sensitive data ending up with a third party, and full control over what we keep and for how long.

Acting fast instead of waiting for days

The moment something gets flagged, we act on it immediately. No waiting days for the next scheduled release, just figuring out right away if and how we need to patch. For projects where we provide advancement & support, that's a standard part of the deal. During a code review of an existing project, we also account for dependency risk by default.

Building software doesn't stop at delivery. Keeping an eye on it doesn't either.

Curious how we'd approach this for your application or website? Send us a message.