Node.js Considers Public Workflow for Security Reports Amid AI-Driven Surge

The Node.js Security Working Group is considering a proposal to move lower-severity HackerOne vulnerability reports into a public workflow while keeping embargo handling for clearly critical issues, driven by a sharp increase in largely AI-generated, duplicate or low-signal reports; maintainers are debating whether this reduces private triage load or merely shifts work to public review, with the topic scheduled for discussion on July 9, 2026.