I agree to a point. However, if such a problem was reported to LedgerSMB here is how we handle it: 1) Scope out the problem. What's affected? Are other rel

I agree to a point. However, if such a problem was reported to LedgerSMB here is how we handle it: 1) Scope out the problem. What's affected? Are other related open source projects affected? How bad is it? This itself can take a bit of time. We do not rush this because we don't want a full disclosure when it happens to bring other problems into the fore. 2) Within a few days we let the reporter know what we have found and give them a chance to offer feedback. 3) Then we get everyone on the core team together and talk solutions. Once we implement it, we test and release a patch. Two weeks after the patch is released, we release a full disclosure along with a hat tip to the one who discovered it. The whole process takes time. But the fact is that it's generally better to get a full fix out in two weeks than a partial fix out tomorrow. So no, don't burn the midnight oil. More speed, less haste. And this whole thing really doesn't look good for Github.