There's a pretty big problem here, which is that all of the security bugs (the serious ones) are embargoed. So going off of public info is not really useful