(2/5)
π Open Source vulnerability reporting is robust and works most of the time; you only hear about it when it fails. Speedy fixes matter, but breaking embargo puts all users at risk. If responsible disclosure is to survive, this mustn't happen again.