So, all software has two problems. First one is finding, reporting and getting vulnerabilities. Most people don't perform security audits. Most vendors take f

So, all software has two problems. First one is finding, reporting and getting vulnerabilities. Most people don't perform security audits. Most vendors take forever to reply back to security reports. Infuriatingly, many vendors will roll security fixes into the next major release instead of backporting patches and minor versions. The second one is about finding out about disclosed and patched vulnerabilities. Outside of larger institutions where you have someone whose job it is to worry over configuration management and subscribe to every mailing list, the ecosystem for disseminating this information is broken. That's why we've started the https://github.com/rubysec/ruby-advisory-db https://github.com/rubysec/ruby-advisory-db, at least for the Ruby ecosystem.