Building a stronger security process for Meteor

[xet7]

For those, faster progress is nice at ChatGPT remote servers.

Well, that was fast progress. For a little time, with many subagents. But then:

Your usage limit is full. You can continue by adding credits or try again on September 14, 2026 at 10:29 AM.

I feel like these are some credits for code lottery.

Hmm. Well, I have some usage at Claude left. After that, I may try some local AI. After that, I have my own brains to figure out all this slop.

[leonardoventurini]

I was referring to compute and data, local AI is still crap mostly, unless you have a rack of NVIDIA GPUs; I can run some big local models on 256gb of RAM, but they are too slow for my liking. Besides, models today are at 1-3 trillion parameters, not even the 1.5tb Mac Studio would run those. Local AI can be helpful but it’s more like pre-November mainstream agentic AI IMO. Unless you have an extremely sensitive application, then you need local/on-premises, and probably should have the budget for your own AI infra then.

[xet7]

Because I’m out out ChantGPT tokens, I’m currently using Claude Sonnet 5 Low, because it uses least amount of tokens, and works well enough.

Using High setting and multiple subagents uses very big amount of tokens very fast.

[italojs]

@vikr00001

I’m very interested in this also. The most recent info I’ve seen is that LLMs are, of course, great at discovering vulnerabilities, but not yet good at patching them.

I believe the outcome will always depend heavily on how these tools are used. In my view, discovering vulnerabilities often takes more time than fixing them. Attacking a framework requires analyzing many different components and scenarios; once an issue has been identified and understood, the appropriate fix is often much clearer.

An LLM may not always be able to implement the right fix on its own, but an experienced human can guide the implementation, review the changes, and validate the result.

@leonardoventurini

Right now the release process for core packages and the Meteor bundle is too slow and requires a lot of work.

We have already automated much of this process with AI. Today, the full release process takes about an hour to complete. That is a significant improvement, although there is still plenty of room to make it faster and more reliable.

@leonardoventurini

Meteor needs to move towards a leaner and lighter architecture extracting core packages (at the very least) to NPM; that way, vulnerable packages can be auditable and addressed granularly.
Bundled tooling like Node.js and Mongo should be able to be upgraded independently; they should be only batteries included recommendations, but we should have good tooling for replacement as well as documentation.
I would completely get rid of atmosphere, phasing out into a new more modern NPM based plugin system, there is a lot of effort being put into NPM security and it’s the de facto standard, where most security tooling speaks the same language.

@nachocodoner

However, the effort required to reach that point is huge and could have a strong impact on the Meteor community and the migrations needed, raise your hand/like if you’re not tired of breaking changes since the Meteor 3 async transition, bundler changes, and so on.

This is something I would really like to see in Meteor someday. It would undoubtedly require a major effort, but with the newest models, it may be easier than we imagine and perhaps possible to achieve gradually without introducing breaking changes.

I believe this is a direction many people in the community would welcome. However, to be transparent, it is not our highest priority right now, as we are already stretched thin delivering the current roadmap.

I encourage you to continue the discussion in this forum thread. I would be happy to help coordinate a community-led initiative exploring this direction. However, given our current priorities, the initiative would need to be driven primarily by the community.

[leonardoventurini]

@italojs @nachocodoner What are the current roadmap priorities? Will check the thread, thank you!

[italojs]

@leonardoventurini

@italojs @nachocodoner What are the current roadmap priorities? Will check the thread, thank you!

this is the roadmap for 2026 Roadmap | Docs we still didnt discuss about 2027