Node.js Considers Public Workflow for Security Reports Amid AI-Driven Surge

A controversial proposal inside the Node.js Technical Steering Committee would move lower-severity security reports into a public workflow, reserving private embargo handling for higher-severity vulnerabilities. The proposal , opened in February by Node.js security maintainer Rafael Gonzaga, is now on the agenda for the July 9, 2026 Security Working Group meeting, alongside a follow-up discussion on AI-assisted HackerOne triage. It builds on a year of changes to Node.js security intake, including higher signal requirements for HackerOne submissions, expanded threat modeling to narrow scope, au