The Day I Became the One Being pip Installed: My Pre-Release Checks Caught 3 Leaks

(Translation of my Japanese article on Zenn.)

This is part 4 of a series where I keep delegating implementation to AI without being able to read the code, building a vulnerability triage CLI called triage-lens. This installment is about distribution rather than the tool's internals: the tool had been sitting on GitHub, and I published it to PyPI so a single pip install triage-lens brings it in.

A confession first. Shipping took more nerve than any of the feature work did. And three "leaks" actually turned up right before release.

From the installing side to the installed side

I can't read code, but I have typed pip install before. Years ago I dabbled in Python out of curiosity, and the one thing that stuck was the experience of a useful tool arriving in one line. Now that I'm the one publishing, the other side of that one line finally became concrete. Someone builds a thing, shapes it into a package, and puts it on the public shelf called PyPI. That's why it installs in one line anywhere in the world. My turn to put something on the shelf.