How Valkey is fighting back against CVE Slop Submissions - Madelyn Olson
Jay Miller talks with Madelyn Olson, Valkey maintainer and the person who hit the fork button, about how the Valkey project is rethinking CVEs. Madelyn explains why Valkey stopped issuing CVEs for authenticated-user crashes and other low-impact reports. She covers how that approach keeps critical vulnerabilities from being drowned out, and how she uses Claude to triage incoming reports. Chapters: 0:00 Intro: meet the person who hit the fork button 1:03 Why Madelyn created Valkey (and "Placeholder KV") 3:25 How Valkey got its name 5:33 Silicon Valkey, Stardew Valkey, and the Gen Z skits 7:29 How a project stops being open source 9:16 Linux Foundation governance and a vendor-neutral Valkey 12:51 How Valkey has grown in two years 15:32 Valkey's AI policy: "we care that it's slop" 17:22 AI-generated slides and what AI is good at 20:50 AI, bug bounties, and the flood of vulnerability reports 21:53 What counts as a CVE in Valkey? 23:21 How AI agents started finding real bugs 25:29 When high-severity CVEs plateaued and low-value reports piled up 27:49 Why crashes and soft-limit bypasses aren't CVEs 31:40 Triaging reports and treating downstream problems as downstream 34:38 Who's reporting these, and is there still a path into security research? 37:45 Mourning the old on-ramps to open source 41:01 Sharing Valkey's CVE strategy with other projects 42:07 Shrinking embargoes toward day zero 43:34 Play, 60+ repos, and staying curious 46:02 Wrap-up RESOURCES Create your free Aiven account: https://go.aiven.io/jay AIVEN DATA PLATFORM The Aiven Platform is more than a collection of open source services for streaming, storing and analyzing data. The platform ensures that all services run reliably and securely in the clouds of your choice, are observable, and can easily be integrated with each other and with external 3rd party tools. CONNECT WITH US Website: http://aiven.io LinkedIn: https://www.linkedin.com/company/aiven/ GitHub: https://github.com/aiven X: https://twitter.com/aiven_io