In the context of security policy, open source projects are "vendors". It doesn't matter that it's not a company. You only care about the result (when things ar

In the context of security policy, open source projects are "vendors". It doesn't matter that it's not a company. You only care about the result (when things are patched and released), not how it happens. Of course with open source you can fix it yourself, but in this context the stats are about how upstream behaves.