“I’ve been doing this long enough to know that most of the secrecy around security issues is just theater.”
The unpaid maintainer of libxml2 spends hours each week on security reports from companies that pay him nothing. Joining OpenSSF requires a Linux Foundation membership of at least $10,000 a year. He just quit libxslt, and nobody is likely to take it over. Big tech ships this code everywhere and sends deadlines instead of money.