There is no argument against having a policy for receiving, reviewing and patching security reports. It is that simple. "hundreds of other bits of (unsafe, unt

There is no argument against having a policy for receiving, reviewing and patching security reports. It is that simple. "hundreds of other bits of (unsafe, untested) social networking code floating around the interwebs" is not a benchmark that this project should aspire to.