This project is security software. People use it to protect their data, so a mistake here is not like a typo in a website.
It can have catastrophic implications for applications trusting it to be secure.
That means correctness always comes first, and we are careful about what we accept.
The maintainers also care about the code itself, not just whether it works.
We want it to stay consistent, easy to read, and comfortable to work on, years from now, for actual human beings.
Code that nobody can follow is code that eventually turns into a liability, no matter how well it tests.
So here is our policy on AI.
We do not accept contributions written by AI.
If a patch was generated by a model, we will not merge it.
The reason is not that AI cannot produce code that works. Sometimes it can, though that is its own risk.
The real problem is that AI writes in a style that humans struggle with.
The comments, the commit messages, the explanations, the structure of the code itself, it all comes out polished and thorough and somehow still very hard to truly understand and reason about.
When a human maintainer has to review it, fix it, or build on top of it, the experience is not good.
We also close issues and pull requests that were clearly written by AI.
Those messages tend to be long, convoluted, and draining to read, and they rarely capture what the person actually needs.
This project runs on human interaction, and we would like to keep it that way.
Please talk to us as a person, like a person.
That said, if an AI agent found something interesting, a bug, a missing feature, a performance issue, we are still happy to hear about it.
Just do the homework first.
Read the code yourself, understand what the model was talking about, and make sure it is actually real. Then explain the suggestion in your own words, like a human would.
If you cannot explain it, that is a good sign you do not understand it yet, and honestly, neither will we.
Thanks for reading, and thanks for caring about the project.