I gotta say, the Mastodon security disclosure for tomorrow's vuln puts most vendors to shame - and Mastodon are a non-profit doing open source code.
They just emailed me to let me know (I've never contacted them before, they've used the contact address on my Mastodon server) the details, including how it was found, how serious and when time wise the patch will be released during the day tomorrow.
I pay Microsoft 9 figures in licensing at job and they sometimes don't even issue a CVE.
You can't aim to build something better than big players without looking at what they do wrong and do something different. I feel that here, we aim to be something the big players are NOT which is open, honest, private, respecting and PROFESSIONAL.
Great work, lets keep it up.
