Gotcha, yeah, hear you about the current state of vuln assessment. Many commercial vuln detect tools that work at the source level are very mature; the most cri

Gotcha, yeah, hear you about the current state of vuln assessment. Many commercial vuln detect tools that work at the source level are very mature; the most critical recent issues have been supply chain- a trustworthy library suddenly becoming untrustworthy- and which could be scored (evaluating contributor behavior in the repo on top of the code itself). But google and other folks are all over oss supply chain security now, so it is more commercial/mature than research. Going after LLM generated code will present the opposite problem- instead of "oh someone is doing this and someone is doing that and so and so is doing the other thing, what could I possibly do", you have "there is this problem and this other problem and that other other thing and no one is really paying attention to any of this, how can I pick just one thing to do." Still a tough problem but a better landscape for a researcher, looking for ways to contribute. Good luck.