// All advisories follow coordinated disclosure. The default window begins at vendor notification and may be extended when a concrete remediation plan is in progress. Default window: 90-day default. See the disclosure policy.

// feeds: advisory-only RSS, combined RSS, security.txt.