1.2 KiB
1.2 KiB
Continuwuity Advisories
In the interest of transparency, this repository contains an archive of every published security advisory issued by the Continuwuity team. Advisories that are invalid/dismissed are not included here. Details regarding advisories will still make their way into changelogs.
See our security policy for more information: https://continuwuity.org/security.html.
Why not CVE/GHSA?
- Depending on a centralised authority to issue advisories for us is not a fantastic idea, and is also ironic when our software is centered around decentralisation.
- Filing CVEs and GHSAs gives people the wrong impression about the project - all too often people see a count above zero and worry that the software is inherently insecure, when in practice this is not the case.
- Using the CVE database encourages low-quality reports from people who just want shiny badges to put on their CV (which harms the project).
Why are the numbers non-linear?
We don't approach every security report in chronological order: there may have been other reports in between A and B, and there are several factors that affect prioritization (e.g. complexity, severity, availability).