{
  "id": 18820466,
  "title": "Dear Open Source Developers: It's OK not to embargo",
  "url": "https://urgent.news/2026/11/07/dear-open-source-developers-its-ok-not-to-embargo",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-11-07T23:31:05.000Z",
  "source": {
    "name": "Lobsters",
    "slug": "lobsters",
    "url": "https://opensourcesecurity.io/2026/10-embargo/"
  },
  "original_language": "en",
  "account": "Open source developers now have the option to handle low and medium severity vulnerabilities differently. Instead of waiting for a private embargo period before making them public, they can simply report these issues in the public issue tracker. This change comes from Curl, a popular open source project, and is aimed at reducing the overwhelming number of vulnerability reports they receive.\n\nThe traditional approach involves privately reporting a vulnerability to the project or vendor, allowing them time to fix the issue before it becomes public knowledge. However, with the sheer volume of vulnerabilities being reported daily, this method is becoming more and more impractical. Many developers are volunteers who are already stretched thin and may not have the resources or time to handle embargoes properly.\n\nFurthermore, not all vulnerability reports are security-related; some are just regular bugs. This new policy encourages developers to treat such lower-severity issues as regular bugs, rather than treating them as special cases that require additional scrutiny. By adopting this change, open source projects can alleviate some of the pressure they face when dealing with the massive influx of vulnerability reports.",
  "summary": null,
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 2,
    "also_reported_by": [
      {
        "outlet": "Lobsters",
        "title": "A Maintainer's Advice on Contributing to Open Source in 2026",
        "url": "https://urgent.news/2026/11/07/a-maintainers-advice-on-contributing-to-open-source-in-2026",
        "published": "2026-11-07T03:43:48.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}