Lately I've been wondering how to handle security vulnerability reports for my (volunteer) projects. Specifically:
1. Do we really need to keep vulnerability reports confidential? If private, that means I am the only one who can fix it, and I might not have the time/interest. Some other important bugs are not reported privately, and many projects are not public-facing network servers. If the vulnerability was found via an LLM, anyone can throw an LLM at the codebase and find it too with little effort.
2. How much do I really need to care about CVEs? This is just time-consuming paperwork for me. I understand it might be important for security researcher recognition.
3. What happens if the security vulnerability isn't patched in a timely manner, or by the end of the embargo period? Should I feel bad? What if it affects the reputation of the software? I don't want this stuff to invade my life.
I very much care about making things right for users, but I don't know how to balance things out with a healthy maintainer role.
