Skip to content
CommonLayer
Documentation menu
On this page

ADR-0030: Embargoed findings never change a project's public security state

Status: Accepted (WP-10). Implemented in crates/commonlayer-projects/src/domain/derived.rs.

Context

A project's security state (not_scanned, stale_scan, issues_overdue, issues_within_sla, no_known_issues) is public. Findings under coordinated disclosure are embargoed and visible only to the project's security roles. If an embargoed finding moved the public state to issues_overdue, the state itself would leak that an undisclosed vulnerability exists.

Decision

Only non-embargoed open findings count towards the derived security state, and overdue findings count only while such a visible finding exists.

Consequences

  • During an embargo the public state can look better than the private truth. That is intended: the embargo is an explicit, audited decision, and disclosure updates the state on the next refresh.
  • Notifications follow the same rule: embargoed findings are sent only to people entitled to see them and never to webhooks or GitHub issues (WP-15).