> Bun's Rust port has not shipped in a released build yet. The Bun you install today still runs the original Zig implementation. This audit is the pre-release pass over the port.
That's good to see. I was getting a bit worried but now feeling better about it.
Porting is usually a messy process. Do you know it's less safe than the Zig version? Maybe it's just highlighting where the problems already existed. Regardless, wild hyperbole are not constructive.
As a human I would likely port it the same way. First a translation close to 1:1 from the source, then redesign/refactor areas little by little to match the target language idioms
C2Rust, the most popular transpiler from C to Rust will leave a bunch of unsafe blocks. After the initial port it is expected for the authors to go in and work to remove them.
Wow, this page looks so bad information-wise. There's a trend with such LLM "reporting" of just throwing bunch of numbers, graphs, charts, whatever on the page. Looks impressive from the outside, totally incomprehensible when you try to actually read it.
Could you imagine if Postgres decided to yolo a port (even if unreleased) to rust? Why port the whole thing like this? Why not do it piecemeal and get each piece to prod?
Look no further than their owner for the reason, unless it is merely a coincidence this only happened after a change in ownership…
Assertions without context, charts about other charts, numbers (so many numbers) without data. An audit with no auditor. Pure infoslop. What a time to be alive.
If you want to dig into Bun's port to Rust, I suggest waiting until they actually release something instead of generating LLM slop charts about unfinished source code.
13k unsafe blocks is a reminder that unsafe on its own isn’t the problem, it’s whether that unsafe boundary is small and audited. The number that matters more is how much of the codebase depends on unchecked invariants. If the answer is most of it, the port is moving too fast.
27 comments
[ 2.9 ms ] story [ 50.5 ms ] thread> Bun · Rust codebase audit · May 21, 2026 · AI generated
nice of them to be up-front about it, I guess.
the port is AI slop, littered with 13k unsafe blocks.
and this blog post is more AI slop, claiming to present a "plan" for how to reduce that number.
why should anyone trust anything they output? all they're trying to do is cover up their slop with more slop.
if you're cleaning your house, and the dirt can't all fit under one rug, the obvious solution is to buy another rug.
That's good to see. I was getting a bit worried but now feeling better about it.
Porting to a safe language without the safety features.
Look no further than their owner for the reason, unless it is merely a coincidence this only happened after a change in ownership…