{"action":"closed","issue":{"url":"https://api.github.com/repos/linuxfoundation/cii-best-practices-badge/issues/183","labels_url":"https://api.github.com/repos/linuxfoundation/cii-best-practices-badge/issues/183/labels{/name}","comments_url":"https://api.github.com/repos/linuxfoundation/cii-best-practices-badge/issues/183/comments","events_url":"https://api.github.com/repos/linuxfoundation/cii-best-practices-badge/issues/183/events","html_url":"https://github.com/linuxfoundation/cii-best-practices-badge/issues/183","id":128897226,"number":183,"title":"Confusing recommendation(s) about vulnerability reporting.","user":{"login":"kfogel","id":401111,"avatar_url":"https://avatars.githubusercontent.com/u/401111?v=3","gravatar_id":"","url":"https://api.github.com/users/kfogel","html_url":"https://github.com/kfogel","followers_url":"https://api.github.com/users/kfogel/followers","following_url":"https://api.github.com/users/kfogel/following{/other_user}","gists_url":"https://api.github.com/users/kfogel/gists{/gist_id}","starred_url":"https://api.github.com/users/kfogel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kfogel/subscriptions","organizations_url":"https://api.github.com/users/kfogel/orgs","repos_url":"https://api.github.com/users/kfogel/repos","events_url":"https://api.github.com/users/kfogel/events{/privacy}","received_events_url":"https://api.github.com/users/kfogel/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2016-01-26T18:11:48Z","updated_at":"2016-01-27T18:40:41Z","closed_at":"2016-01-27T18:40:41Z","body":"The section \"Vulnerablity Reporting Process\" has this criterion:\r\n\r\n> The project MUST provide an initial response to a vulnerability report, on average, less than 7 days within the last 6 months. (If a project is being spammed on its vulnerability report channel, it is okay to only count non-spam messages.)\r\n\r\nI don't understand what the first sentence means.  At first I thought it was talking about reponse time, saying that the project should respond within 7 days.  But then what is the \"within the last 6 months\" about?  Surely the criterion is not requiring that projects receive at least one vulnerability report every 6 months :-).\r\n\r\nSeparately from that, the parenthetical second sentence is unnecessary.  A spam message is not a vulnerability report, and therefore has no relevance to this criterion or this section anyway.  Everyone knows it's okay to ignore spam; I'd say just eliminate the parenthetical."}}