Dolibarr
↳ MERGEDCorrected the patched-release boundary while explaining why a later maintenance release remained affected.
GHSA-2mfj-r695-5h9r · 2026-10-26 02 / SECURITY INTELLIGENCE
The details matter.
The evidence matters more.
Accepted advisory contributions, remediation tracking, and tools for the quality of vulnerability information.
43
accepted public
advisory credits
THE WORK, ACCURATELY ATTRIBUTED
My public advisory credits primarily reflect analysis and improvements to existing records: version boundaries, fix references, and metadata quality. They do not imply that I discovered the underlying vulnerabilities.
8 selected examples are highlighted below from the larger public record.
View the current credit recordTHE PUBLIC RECORD
SOURCE: GITHUB ADVISORY DATABASEApostropheCMS
↳ MERGEDDocumented the patched release and remediation reference, including the relevant release-line caveat.
GHSA-vmg4-6gfg-83qx · 2026-10-28FacturaScripts
↳ MERGEDRecorded the patched-release boundary and linked the CSV/XLS export hardening change.
GHSA-2p5x-4jr6-x5jg · 2026-11-02NotrinosERP
↳ MERGEDLinked the employee-document upload remediation and documented the fixed release.
GHSA-qv4m-m73m-8hj7 · 2026-10-27Goploy
↳ MERGEDUpdated release information and the path-validation fix reference for file endpoints.
GHSA-4g5x-hcwm-82jw · 2026-10-27Vikunja
↳ MERGEDRecorded the patched release and linked the task-search scope correction.
GHSA-fprf-r6rv-xg99 · 2026-10-27wger
↳ MERGEDAdded the existing fix-commit reference for workout-log ownership validation.
GHSA-rjpf-7pf5-q54x · 2026-10-26OpenAM
↳ MERGEDLinked the existing commit that fixes insecure SSO-cookie initialization.
GHSA-fpmh-vx4h-xc33 · 2026-10-28A curated snapshot of 8 examples from the public record of 43 accepted advisory credits. The public evidence ledger dated November 3, 2026; not a live total. Each arrow opens the primary pull request. Inspect the evidence index ↗
FIELD NOTE / 001
A later release
isn’t always a safer one.*
The Dolibarr contribution documents a subtle release-line problem: a later maintenance release could remain affected even after a fixed major release existed.
That is why a version number alone is not enough. The accepted change connects the boundary to evidence rather than an assumption about release order.
Read the accepted contribution * A case study of advisory metadata, not a claim of original discovery.Show the source.
Public statements should lead to public records, not just a bigger counter.
Name the actual role.
Analysis, discovery, and remediation are valuable—and different.
Stay authorized.
Defensive review and responsible disclosure. No testing without permission.
A GOOD IDEA DESERVES A CONVERSATION.
Interesting problem? Thoughtful collaboration? Start here.