About KeePassXC's Code Quality Control • Hacker News Board

Re: About KeePassXC's Code Quality Control

#31

Post by phoerious » Sun, Nov 09, 2025, 7:12 PM UTC

Lariscus wrote: post #22

I didn't know about that and this is really concerning to me. AI has no place in security critical software like KeePassXC, and I remain unconvinced that they will only use it for simple tasks. I don't feel like I can trust this software any longer this is a password manager not just some random website where bugs basically don't matter. I hate that I have to replace yet another piece of software that I liked.

Our entire development process is open on GitHub. You can see where we use or accept AI at any time.

Re: About KeePassXC's Code Quality Control

#32

Post by ysleepy » Sun, Nov 09, 2025, 7:44 PM UTC

Tell yourself what you want, but this sort of AI positive proclamation will make your project seem less trustworthy to many people.

I choose not to use a vibe coded password manager, rigorous review or not, to protect my entire digital existence, monetary assets and reputation.

It's the pinnacle of safety requirements, memory unsafe language, cryptography, incredibly high stakes.

I have the distinct displeasure having to review LLM output in pull requests and unfailingly they contain code the submitted doesn't fully understand.

Re: About KeePassXC's Code Quality Control

#33

Post by AlexErrant » Sun, Nov 09, 2025, 8:11 PM UTC

Y'know how there's "security theater"? https://en.wikipedia.org/wiki/Security_theater

I think there's an analogous subset: "llm-security theater".

There's so much pearl-clutching, pedantry, and noise from people who are obviously 1) not contributing to KeePassXC AND 2) never would contribute AND 3) are unaware of EXISTING bugs/issues/CVEs with KeePassXC. All they provide are vague abstract arguments from their own experience with LLMs, and they argue with the maintainers of KeyPassXC without giving specifics, as though they have the right to tell others how to run their repo when they're unable to link a single concrete problematic issue or PR.

Instead, all they have are "vibes", which is ironic.

Re: About KeePassXC's Code Quality Control

#34

Post by Lariscus » Sun, Nov 09, 2025, 8:12 PM UTC

phoerious wrote: post #31

Lariscus wrote: post #22

I didn't know about that and this is really concerning to me. AI has no place in security critical software like KeePassXC, and I remain unconvinced that they will only use it for simple tasks. I don't feel like I can trust this software any longer this is a password manager not just some random website where bugs basically don't matter. I hate that I have to replace yet another piece of software that I liked.

Our entire development process is open on GitHub. You can see where we use or accept AI at any time.

That's all nice but I still don't want slop code in an application as security critical as a password manager. The correct percentage of slop code for a password manager is 0% and it’s pants on head crazy to claim otherwise.

I have dug around a bit and found a thread mastodon thread that doesn't inspire confidence[1]. KeePassXC seems completely untrustworthy at this point not only have they jumped on the AI bandwagon, they also seemingly don't know what a zero-day is. I genuinely liked KeePassXC and used it for years now I am spending my Sunday evening researching alternatives.

[1] https://fosstodon.org/@2something@transfem.social/1148367097...

Re: About KeePassXC's Code Quality Control

#35

Post by AlexErrant » Sun, Nov 09, 2025, 8:25 PM UTC

PaulKeeble wrote: post #21

I am now on the hunt for a non vibe coded alternative. I stopped open sourcing code after all my open code's licenses were broken by Microsoft and everyone else commercialising it. Which I guess is part of the point of why they did it and have put serious money to defending themselves in court against anyone that dare challenge it. Suffice to say I don't want anything to do with projects that participated in that the…

The original Keepass project has 11 CVEs. XC has 3, and has disputed all of them with e.g. "the vendor disputes this because memory-management constraints make this unavoidable in the current design and other realistic designs", etc.

Re: About KeePassXC's Code Quality Control

#36

Post by Barrin92 » Sun, Nov 09, 2025, 8:42 PM UTC

jpeterson wrote: post #4

Code submissions either meet the standards of the project or they don't. Whether it was generated by human or AI is irrelevant.

>Whether it was generated by human or AI is irrelevant.

No. These systems are still so mindboggingly bad at anything that involves manual memory management and pointers that even entertaining the idea of using them for something as critical as a non-trivial large c++ codebase, for a password manager no less, is nuts. It displays a lack of concern for security and propensity for shortcuts that I don't want to touch anything by people who even remotely consider this appropriate.

Re: About KeePassXC's Code Quality Control

#37

Post by 0x_rs » Sun, Nov 09, 2025, 8:57 PM UTC

There's no way to determine whether a contributor used LLMs in part or full, not without them being honest about it. With that in mind, this seems like a reasonable position. Been using KeePassXC since forever and will continue to do so. It might feel wrong to some, but these changes are inevitable and it's best to be prepared and become acquainted with that now rather than later.

Re: About KeePassXC's Code Quality Control

#38

Post by cadamsdotcom » Sun, Nov 09, 2025, 9:04 PM UTC

> we still code ourselves for work and for fun. This will not suddenly go away because we have another tool in our belts.

AI is just another way to write code. At the end of the day code is just text. It still needs to be reviewed - nothing about that is changing.

Re: About KeePassXC's Code Quality Control

#39

Post by droidmonkey » Sun, Nov 09, 2025, 9:07 PM UTC

AlexErrant wrote: post #35

PaulKeeble wrote: post #21

I am now on the hunt for a non vibe coded alternative. I stopped open sourcing code after all my open code's licenses were broken by Microsoft and everyone else commercialising it. Which I guess is part of the point of why they did it and have put serious money to defending themselves in court against anyone that dare challenge it. Suffice to say I don't want anything to do with projects that participated in that the…

The original Keepass project has 11 CVEs. XC has 3, and has disputed all of them with e.g. "the vendor disputes this because memory-management constraints make this unavoidable in the current design and other realistic designs", etc.

Additionally, the original KeePass project has no public development or public review process for their code. They do everything behind the scenes and only publish code when a release is made. KeePass is "code available" open source.

Re: About KeePassXC's Code Quality Control

#40

Post by snowwrestler » Sun, Nov 09, 2025, 11:37 PM UTC

I feel like a lot of the comments here do not understand how KeePassXC actually works. It’s a client application that works with a standard encrypted file format. The file format is the basis for security, not the client application.

KeePassXC does not store any data. Nor does it receive connections from the Internet, like a server. Thus the risk is structurally lower than a commercial client-server application like LastPass or 1Password, which is actually in possession of your password data.

I use 1Password at work for its excellent collaboration features and good-enough security. For most people it replaces a post-it note or Excel file. It’s way better than those.

But for my passwords I use KeePass (the file format) and a variety of clients including KeePassXC. This statement about AI won’t change that, unless someone can give me a reason other than vague “AI bad” or “no vibe coding” like most comments so far.