Project "OpenJS: AI Vulnerability Disclosure"

The contract concerns the project OpenJS: AI Vulnerability Disclosure, which covers research into how Node.js handles reports of security flaws now that artificial intelligence finds those flaws faster and in greater numbers. As part of four work packages, the contract covers rules and tooling for deciding which reports can be handled in public, a pilot that tests this on Node.js, a comparison of the results with the project's past record, and published guidance for other projects. The aim of this service is to keep security fixes for Node.js fast and reliable, and to give other open source projects a tested way to do the same.