[Ekhorn]

Documents the parts of 6.4 that were only in people's heads, and replaces a workaround with the built-in option.

• One vulnerability per advisory. Cites CNA rules 4.1 and 4.2, which GitHub applies when issuing a CVE. A report with independently fixable vulnerabilities is split into one advisory per vulnerability, each with its own CVE; separate reports of the same weakness are merged with every reporter credited, and reporters are told the outcome either way.
• Severity. Adds severity scoring is done with CVSS, with vector example and what to do when it misrepresents real world risk.
• Merge authority unchanged, named properly. Still the product owners, now written as the openremote/product-owners team rather than the "Product Owners" group. Clarifies merge authority i.e. who can merge and why.
• Branch-protection workaround replaced. The old instructions had the merger temporarily untick "Do not allow bypassing the above settings" and remember to re-enable it afterwards. The advisory page offers Merge and bypass branch protections directly, so the protection settings no longer have to be edited at all.
• Local checks before merge. The fork runs no CI, so the pipeline checks have to pass locally before a fix is proposed for merge. Previously implicit.
• Publication does not always wait for a fix. An advisory with a planned fix is published once a release containing it is public. A confirmed vulnerability that will not be fixed is published anyway, stating that no fix is planned and documenting mitigations, matching the advisory tracker, which treats that case as publishable.
• Split into Developing the fix, Merging and Publishing, and moved the hard line breaks from trailing spaces to \. The fork mechanics are unchanged.

[wborn]

This is an initial AI-assisted review.

Two workflow inconsistencies should be resolved before merging. The handbook broadens the CVE splitting rule beyond independently fixable vulnerabilities, and its publication rule conflicts with the related advisory tracker by requiring a fixed release even though valid vulnerabilities with no planned fix are explicitly considered publishable. There is also one smaller documentation cleanup around obsolete branch-protection guidance. Details are in the inline comments.

[wborn]

One minor documentation consistency issue remains around the triage terminology.

This review was AI-assisted.

[wborn]

LGTM now!