4 ms·

Okay, but I mean the initial finders of the vulnerability. If they are conducted manual code reviews, automatic static analyses or fuzzing.

• tadfisher 3y ago
  Visit the link in the comment to which you're replying.
  • hannob 3y ago
    I think he is talking about NSO group, or whoever sold it to them. However, obviously that's unlikely to get revealed.
    • insanitybit 3y ago
      I have to imagine that NSO group just watches the commit log for "I optimized webp" lol it's free CVEs
• saagarjha 3y ago
  All of the above.