A lot of astronomy software relies on established open source code. A security bug in that code affects every system built on top of it, so I focus where a fix protects the most people. I report what I find responsibly, and work with the maintainers until it's fixed.
As of –
I read a project's SECURITY.md first and report the way it asks. If there isn't one, I contact the maintainers directly. Every report includes steps to reproduce the problem, and a suggested fix where I have one.
My default is 90 days from the report, which is the industry standard. If the maintainers are working on a fix, I'm happy to extend it and ask what they need.
I keep bug details private until a released version with the fix is available, and that includes the name of the library. Until then, a report only shows up in the anonymised numbers above.
Once the fix is out, I credit the maintainers and may write up what happened. Write-ups go in the Disclosed section below.
I look for security bugs in open source software the astronomy community relies on. Most are memory safety bugs (where a program reads or writes past the end of its buffer). My work is defensive only. I check every finding independently before I send it, so maintainers aren't chasing ghosts.