Handling security bugs is not the open-source community’s strong point (trust-in-soft.com)