OSS + ELC EU 2026

Zephyr’s security response is run by a small, mostly volunteer team handling a large and growing workload. Every vulnerability report must be triaged against a million-line codebase, confirmed in source, scored, mapped to a CWE, written up as a CVE record, documented for disclosure, and tracked across multiple release branches — often under embargo deadlines that don’t move. It’s repetitive, high-stakes work, and it’s exactly the kind of burden that burns maintainers out.

This talk is a candid look at how we started using AI to help: grounding analysis in the source tree with file:line citations, drafting CVE records against a strict schema to prevent fabricated fields, and reducing release vulnerability accounting from hours to minutes. It covers what worked, what failed, and the guardrails we built to keep a human in the loop. You’ll leave with a practical blueprint and checklist for using AI in security response — and an honest view of where it helps and where it’s still a liability.