Snyk vulnerability disclosure program: what’s going on behind the scenes?

Snyk outlines its responsible vulnerability disclosure program and a collaboration with Johns Hopkins University that produced a large-scale disclosure of 57 Node.js vulnerabilities. The report explains how Snyk triages reports, coordinates with maintainers, assigns CVEs, and publishes advisories, and highlights vulnerability types found (command injection, prototype pollution, arbitrary code execution, path traversal) and several example advisories.