Vulnerabilities and Responsible Disclosure

The Eclipse Foundation has a policy regarding the resolution and responsible disclosure of identified vulnerabilities. The short version is that this is one of the rare areas where open source transparency and openness ideals may be curtailed for a period of time while a vulnerability is addressed privately; but that all identified vulnerabilities, regardless of whether or not they are fixed, must be disclosed after no more than three months.