Episode

The AI-Induced Death of A Bug Bounty Program with Glauber Costa

Podcast
The Business of Open Source
Published
Jun 1, 2026
Duration seconds
2613
Processing state
not_requested
Canonical source
https://share.transistor.fm/s/9e816915
Audio
https://dts.podtrac.com/redirect.mp3/media.transistor.fm/9e816915/9c521100.mp3
JSON
/v1/public/podcasts/the-business-of-open-source-1246517/episodes/the-ai-induced-death-of-a-bug-bounty-program-with-glauber-costa
Markdown
/podcast/the-business-of-open-source-1246517/the-ai-induced-death-of-a-bug-bounty-program-with-glauber-costa.md

Actions

  • POST https://stenobird.com/v1/public/podcasts/the-business-of-open-source-1246517/episodes/the-ai-induced-death-of-a-bug-bounty-program-with-glauber-costa/transcription-requests
    Idempotently request low-priority transcript generation for this episode.
  • GET https://stenobird.com/podcast/the-business-of-open-source-1246517/the-ai-induced-death-of-a-bug-bounty-program-with-glauber-costa.md
    Read the agent-friendly Markdown representation of this episode resource.

Summary

The Business of Open Source is back! I’m starting a series about AI and open source this week. I reached out to Glauber Costa , founder of Turso , after reading a post of his on LinkedIn about how bot-written PRs for their bug bounty program forced them to discontinue the program completely. In this episode, he talked about the bug bounty program — how it started, who contributed to it initially, why he considered it a huge success. And then he talks about what started happening when bots entered the picture. He also talked about the difference between an open source project that accepts contributions and one that doesn’t, about the difference between an open source project and software that’s in the public domain, and how people in open source used to be seen as weirdos who hate money. Glauber isn’t an AI hater — he talks about how they use AI at Turso, and how he has no problem with AI-assisted pull requests. The issue is when the result isn’t high-quality. There's also a difference between AI-assisted and 100% bot written. Then it creates essentially a denial of service attack on the community, because the maintainers end up having to spend so much time responding to bot-created PRs. What’s your experience with AI and Open Source? Who else should I talk to? Let me know. Do you like The Business of Open Source? Help it to continue to exist by sponsoring the podcast. Does your company have a positioning problem? Work with me to better position your product and see your growth take off.