AI policy

[mttaggart]

Given some other major projects' rather unfortunate embrace of generative models in their development pipeline, it would be reassuring to me (and many others, I'm sure) for this project to adopt a firm stance on the use of generative code. Ideally, that stance would be one of categorical rejection, but clarification of the policy in any direction would be deeply appreciated.

[vae-21]

Just found out today that apparently Bitwarden is using vibe coding these days, which I thought was the push I needed to switch to KeePassXC. Only, they also use sparkly autocorrect.. Using Vaulwarden with Bitwardens browser extension wouldn't be ideal, but better than the current alternatives at least. Assuming this project does have a "no 'ai' allowed" stance?

[stefan0xC]

To my knowledge there only has been one (obvious) attempt to submit a PR with AI generated code #6193 (comment) which has not been accepted - so yeah I don't think that we formally have such a policy since it hasn't become a problem yet (I mean we don't have our own code of conduct either but rely mostly on common sense and that users adhere to the side-wide acceptable use policies which sets some guidelines for collaborative work for all users).

Given that the use of generative AI raises also ethical concerns about copyright infringement and might even be incompatible with the AGPLv3 license if it's reusing incompatibly licensed code verbatim I would caution against accepting PRs written by generative AI and I'd also support a firm policy against that but I can't speak for the maintainers. Since @BlackDex requested a review from Copilot (in the above PR but also in #5742 (comment) 8 months ago) it might be a different question to use it for reviewing purposes. However judging from the quality of the review (as it seems superfluous or rather questionable as well) and because it also hasn't been used since I don't think that we will really embrace AI like KeePassXC has done anytime soon anyway because reviewing code (even seemingly simple ones) takes time as well. And yeah I'd rather we work on a proper testing infrastructure before starting to rely on AI written code.

Disclosure: I have used Copilot myself once to generate an architecture diagram for Vaultwarden #5847 (comment)