malicious code ≠ vulnerabilities

Read the full board notes here: gist.github.com/wiggitywh…

Handwritten lightboard in green, yellow, and pink chalk on black titled "HOW DATADOG DETECTS MALICIOUS CODE AT SCALE." Top left reads "malicious code ≠ vulnerabilities" above a section on "The Attack Surface" listing Vector 1 (pull request, example: exfiltrate secrets via CI config) and Vector 2 (packages, example: attacker compromises pkg maintainer, backdoor ships in next update), with a definition of BewAIre as software that automatically analyzes pull requests and packages to detect malicious changes. Center section "How It Works" diagrams a flow from a pull request event and third-party package source code into a "BewAIre API" box containing step 1, a pre-filter labeled fast, cheap, ex GPT mini, asking "Suspicious or not?", and step 2, AI-powered escalation ex Claude Opus, which looks at author info, comments, metadata, and dependencies, with an annotation that 0.02% gets escalated to human review and 99.98% is filtered out. The flow returns a verdict and reason (malicious or benign) that goes to human triage via the security incident team or security research team. Right section "How It Scales" lists scanning every PR event and every package release, notes the pre-filter and escalation steps' speed, cost-effectiveness, and precision as why it scales, a "BewAIre Detects" list (token exfiltration, encoded payloads, backdoors, typosquatting, and more), and a "Whats Next" list (stronger enforcement, improving and extending package scanning).