Skip to content

Topics
Contributors
About

·

Propose a topic

Loading...

Topics
Contributors
About

·

Propose a topic

Loading...

Topics
Contributors
About

·

Propose a topic

← AI is finding security bugs faster than maintainers can fix them. Should the 90-day disclosure deadline change?

Keep 90 days
Give maintainers more time
Keep the deadline, make the finders fix it
Shorten the deadline

kolliden · Nov 5, 2026

Keep the deadline, make the finders fix it

3 reasons3 sources

·

What this position proposes

The deadline stays, but companies that report bugs at scale with AI also have to supply tested patches or pay for the work of fixing them.

Reasons

1.
Finding bugs has far outrun fixing them, so the bottleneck is the fixing, not the deadline.^[1]
1. Source 1: Atlantic Council: New AI models are pushing open-source security to its limits. Their developers must step up. · atlanticcouncil.orgOpen original
Objections
- Objection · Leaves something out
  Several AI companies are already paying: seven of them gave $12.5 million through the Linux Foundation for triage and fixes.^[1]
  1. Source 1: Atlantic Council: New AI models are pushing open-source security to its limits. Their developers must step up. · atlanticcouncil.orgOpen original
2.
A company that can find a bug with AI in minutes is also the one best placed to write and test the fix.
Unsourced
Objections
- Give maintainers more time · Overstated
  AI-drafted patches are often wrong or below a project’s standards, so maintainers still have to review every one.^[1]
  1. Source 1: Hardware Busters: PostgreSQL 19 slips to November 19 as AI-found bugs swamp its human reviewers · hwbusters.comOpen original
3.
Trillion-dollar companies rely on volunteer code like FFmpeg, so dumping bug reports on its volunteers shifts their costs onto unpaid people.^[1]
1. Source 1: It’s FOSS: FFmpeg calls Google’s AI bug reports “CVE slop” · itsfoss.comOpen original
Objections
- Keep 90 days · Doesn’t follow · Unsourced
  Volunteers chose to publish code that the whole world runs, and reporting its flaws protects the people who use it.

Anyone can add a reason, an objection or a source here. You create a free account when you publish. Already have one? Sign in.

Reasoned.

The strongest case for each side of contested questions, with sources. Found a mistake? Tell us.

All topics Propose a topic Contributors World map About Guidelines Contact

© 2026 ReasonedEarly version: content and features are still changing.Legal notice Privacy Terms Cookies

·

Keep the deadline, make the finders fix it | Reasoned