Why is that not a great sign. All security bugs are non-public, even on Firefox, until they are fixed. The fact that they are non-public is arguably a sign some

Why is that not a great sign. All security bugs are non-public, even on Firefox, until they are fixed. The fact that they are non-public is arguably a sign someone looked at the bug and marked it a security issue which also means it's likely being actively worked on. Keeping the public just means if you want own people's machines you could scan the bug database for bugs marked as "security" and exploit to your heart's content until they were fixed.