The origin story of how zemnmez found this is so hilarious
> i got tricked into finding some 0days in vscode because I got asked to review a vscode based project and didn't notice the 1P devs had only made one minor change to it. actually not a joke
> i got tricked into finding some 0days in vscode because I got asked to review a vscode based project and didn't notice the 1P devs had only made one minor change to it. actually not a joke
Edit: I think I might understand it more now: This person got tricked into carefully reviewing the "entire" code, instead of focusing on the one minor change that was made to it, because they didn't realize it was only the minor change they had to review. In their careful review of the code, they uncovered vulnerabilities which were actually related to the original code (ie. VSCode) rather than the changes that this person was asked to review. Did I get it? I'm still confused about the use of "1P" here though.
edit: correct!
I think one sniff out shifty code, as soon as you open the file you can tell there are going to be bugs in there. I am not saying, well groomed high level code is high quality or bug free. A couple trivial deficiencies and there a probably a whole lot more you don't see.
Like if the code has a low to zero number of tests. Or the build system includes top level shell commands.