Based on real screenshots, this talk walks through the end-to-end vulnerability response process for OSS hosted on GitHub—from report and triage to Security Advisory, CVSS/CVE, patching, and public disclosure. It also covers behind-the-scenes practices such as using a temporary private fork for coordinated, non-public fixes.
Slides for the onsite talk at 3-shake SRE Tech Talk #14. https://3-shake.connpass.com/event/351203/