From 176b0a50bd077e9f636b21cbf3c066f8f434d4ca Mon Sep 17 00:00:00 2001 From: aljo242 Date: Fri, 2 Oct 2026 14:37:15 -0400 Subject: [PATCH 1/2] docs: let the repositories freeze, not the vulnerability The sentence carried one subject through every verb, so it read as the vulnerability being frozen and coming down. Splits it so the dates attach to the repositories. --- SECURITY.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 395c6dd..69fe070 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -173,8 +173,8 @@ month's repositories is granted by fresh invitation on its own schedule, so the retention does not extend anyone's access. As an example, a vulnerability reported on August 12 and patched on August 15 -reaches the private repositories the same week, is frozen on August 25, is -public on September 1, and the August repositories come down on September 15. +reaches the private repositories the same week. Those repositories freeze on +August 25, go public on September 1, and come down on September 15. ### Critical vulnerabilities From a31604088acf48e01c87899b0f057e00c6332bb3 Mon Sep 17 00:00:00 2001 From: aljo242 Date: Fri, 2 Oct 2026 15:22:41 -0400 Subject: [PATCH 2/2] docs: it is the patches that go public, not the repositories The rewrite made the repositories the subject of every verb, so it read as the private repositories becoming public on the first. They stay private until they come down on the fifteenth; their patches are what goes public. --- SECURITY.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/SECURITY.md b/SECURITY.md index 69fe070..9f2f4fc 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -174,7 +174,8 @@ retention does not extend anyone's access. As an example, a vulnerability reported on August 12 and patched on August 15 reaches the private repositories the same week. Those repositories freeze on -August 25, go public on September 1, and come down on September 15. +August 25, their patches go public on September 1, and the repositories come +down on September 15. ### Critical vulnerabilities