model & tooling improvements, giving more weight to higher quality reports and MRs, and more respect for project rules and processes. A mix of soft and hard gates, CLAs, improved early automated bug report & patch reviews and other CI gates

This is exactly what I see happening inside the handful of large software companies into which I have visibility.

We have to deal with the fact that slop or not we all have 100x more security bugs than usual thanks to Mythos and friends, and some of them are real ones that will bit us in the ass if we don’t fix like, now