Bun's author corrects claim that its Claude rewrite avoids security bugs

Valerii Strilets posted that Bun, which he says was completely rewritten by Claude, has never been found to have these kinds of security issues. Jarred Sumner, replying from the Bun account's mentions, answered with two words and a link.

"Unfortunately, not accurate", he wrote.

Jarred Sumner

@jarredsumner

X

Unfortunately, not accurate

Theo replied to the same post saying Bun got hit yesterday too, with a link. The Bun account had already posted that v1.4.4 would ship that evening with a fix for an issue plus a fix for a Brotli issue, and added that both fetch() and Bun.serve() did not and continue to not enable HTTP/3 by default.

Bun

@bunjavascript

X

Bun v1.4.4 will be released this evening with a fix for this and for the Brotli issue.

What is actually being argued

The security detail is the small part. The sources do not say what the vulnerabilities were, who reported them, or how serious they are, and nobody in the thread quantifies any of it. What they do show is the shape of the argument. A codebase that someone describes as AI-rewritten was being held up as evidence that AI-written code is safe, by a person who does not maintain it, and the person who does maintain it said the premise was wrong within the same thread.

It is also worth being precise about the rewrite claim itself. "Completely rewritten by Claude" is Strilets's characterization, not Sumner's. None of the cited posts from the Bun side describe the codebase that way, and Sumner's correction is aimed at the no-security-issues part, not explicitly at the provenance part.

For working engineers

Absence of reported vulnerabilities is not evidence of absence, and it is a particularly bad proxy when the project in question is shipping patch releases for exactly that class of problem. The most load-bearing fact here is the one with a version number on it. Bun said v1.4.4 carries the fixes.

This is a recurring pattern in the arguments we track. Earlier, Theo argued that people who say AI cannot write good code are telling on themselves, and he was making a claim about his own output. Here the claim is about someone else's codebase, and the maintainer showed up to correct it. If you want to argue that agent-written code holds up under scrutiny, the receipts have to come from the people who run the scrutiny.