Affected product and versions must be identified before a public impact claim is made.
DISCLOSURE · AFFECTED · FIXED · WORKAROUND
Security truth.
No silent theatre.
Public advisories are published only when disclosure is appropriate and evidence-backed. An empty list is not a claim that vulnerabilities can never exist.
01 · ADVISORY REGISTER
Every public advisory must identify impact and remediation.
Severity, affected versions, fixed versions, workaround and evidence are explicit fields rather than free-form marketing copy.No public advisory is currently recorded.
This state means the public advisory register is empty. It does not assert zero undiscovered vulnerabilities, zero restricted findings or blanket security certification.
02 · RESPONSE CONTRACT
Report → triage → contain → fix → disclose → learn.
Fixed versions, workaround and mitigation state remain explicit and revision-bound.
Closure requires evidence of remediation or a documented withdrawal reason; silence is not closure.