Continuwuity Advisories

In the interest of transparency, this repository contains an archive of every published security advisory issued by the Continuwuity team. Advisories that are invalid/dismissed are not included here. Details regarding advisories will still make their way into changelogs.

See our security policy for more information: https://continuwuity.org/security.html.

Why not CVE/GHSA?

1. Depending on a centralised authority to issue advisories for us is not a fantastic idea, and is also ironic when our software is centered around decentralisation.
2. Filing CVEs and GHSAs gives people the wrong impression about the project - all too often people see a count above zero and worry that the software is inherently insecure, when in practice this is not the case.
3. Using the CVE database encourages low-quality reports from people who just want shiny badges to put on their CV (which harms the project).

Why are the numbers non-linear?

We don't approach every security report in chronological order: there may have been other reports in between A and B, and there are several factors that affect prioritization (e.g. complexity, severity, availability).