The Software Leaders Uncensored Podcast

The episode contains a few genuinely non-obvious insights - particularly around AI LLMs actively scanning open source for CVEs and the downstream maintainer burnout - but is padded with extended remote work culture chat, Gather Town recommendations, and generic startup growth narrative that delivers no value to a B2B operator.

“we might be approaching a hundred thousand CVEs that get reported this year, which is going to break the scale”

“74% of companies knowingly violating their AI security policies”

The framing of AI coding tools (Claude, Codex) as active vulnerability scanners that are simultaneously creating a CVE tsunami and burning out open source maintainers is a genuinely fresh and counterintuitive angle; however, the vibe-coding-creates-tech-debt thesis and remote work culture discussion are thoroughly recycled territory.

“with Claude and Codex and all of these LLMs pounding these open source libraries for, to look for vulnerabilities, that number looks like it could as much as double”

“the problem is going from this very acute pain of I'm stuck on this one library... to. Now I have thousands of libraries that all have their own life cycles”

Aaron Mitchell is a genuine operator who scaled a niche but real company from 6 to 100 employees and oversees a defensible technical moat in open source lifecycle management; he is not a recycled thought leader, though he operates at modest scale and the conversation rarely probes deep enough to extract his full operational knowledge.

“we have dozens of open source maintainers that work at HeroDevs that are the original maintainers of some of the Internet's biggest projects”

“we spun up a $20 million open source sustainability fund”

The Spring framework data point (17 CVEs in all of 2024 vs. 40+ in two months of 2025) and the Black Duck stat on AI policy violations are specific and credible; however, many claims are hand-waved with phrases like 'it's really damn hard' and the projection of ~100,000 CVEs is asserted without a clear methodology.

“Spring, a very, very ubiquitous popular Java framework... Last year there were 17 vulnerabilities reported... In just the last two months, we've seen over 40 of these vulnerabilities get reported”

“the percentage of companies that are knowingly in violation of their stated AI policies... It was 74%”

The host's hypothetical 'what breaks if you go on cruise control for two years' question is sharp and produced the episode's most candid business-model insight, but the overall craft is undermined by extensive remote work culture detours, excessive praise ('I have the utmost respect for how you answered that'), a generic closing advice question, and overt self-promotion.

“if you were going to say it was easy and you guys have figured everything out and it's simple, my job as this podcast host would be to destroy you”

“Let's just say you fell asleep for two years and you said I just want the company on cruise control... What's the first thing that would break”