Node.js Considers Public Workflow for Security Reports Amid AI-Driven Surge

The Node.js Security Working Group is considering a shift to a public workflow for handling lower-severity security reports due to an overwhelming influx of AI-generated vulnerability submissions via HackerOne. Security maintainer Rafael Gonzaga attributes the surge to LLM-driven fuzzing and scanning tools, which produce highly similar reports, undermining the value of private disclosure. The proposal aims to reduce operational overhead by reserving private embargo processes for high-severity issues while enabling public handling for others, though maintainers remain divided on whether this change will alleviate workload bottlenecks.

AI-extracted · verify before operational use