It is basically unheard of that a researcher would have understated a reported problem so I consider that a low risk scenario.
Eh, I’ve come across security bug reports where the poster didn’t grasp the full implications and how something that looked minor was actually a big deal.
Nowhere near as common as regular bug reports where the poster didn’t think about security implications, of course, but “basically unheard of” feels stronger than I’d expect. Though perhaps more warranted on a mature project like curl where the low-hanging fruit is all taken.
chrismorgan | 8 hours ago
Eh, I’ve come across security bug reports where the poster didn’t grasp the full implications and how something that looked minor was actually a big deal.
Nowhere near as common as regular bug reports where the poster didn’t think about security implications, of course, but “basically unheard of” feels stronger than I’d expect. Though perhaps more warranted on a mature project like curl where the low-hanging fruit is all taken.
djx | 4 hours ago
I'm happy to see a project take steps to protect their longevity rather than burn out and disappear forever.