I'm trying to get a security vulnerability on a Stack Exchange domain fixed for about 8 months, but the lack of progress and communication is frustrating. Unfortunately, asking for status updates repeatedly and offering further details if needed didn't get me anywhere.
- 2017-11-20 Reported vulnerability via contact form (No reply or receipt)
- 2017-11-28 Inquired via email if the report was received (No reply)
- 2017-11-30 Created a meta post asking if the report was received (Got confirmation that it was)
- 2018-02-16 Asked for a status update below meta post (No reply)
- 2018-02-19 Asked for status update via contact form
- 2018-02-20 Received response that "someone’s still looking into the issue" and I "should have a status update soon".
- 2018-07-03 Asked for a status update (No reply)
Being that unapproachable on security bugs not only puts the community at risk, but I feel it's also detrimental to SE's reputation and may discourage other people from reporting vulnerabilities in the future. (I am aware that the XSS flaw I reported is not the end of the world, but there is still a real risk of abuse to a multi-million-user community.)
Posting publicly about the issue here seems to be the only way to grab attention. Would you mind having another look at my bug report and letting me know about its progress?