In reply to Jan Dembowski.

I can definitely sympathize with the headaches you get from what he is doing and understand why you’d attribute further fallout to the way he handles things. (and personalizing the disagreement isn’t warranted at all on his part). It’s definitely not something I would do.

But we cannot speak of “responsible disclosure” without addressing the fact that delisting plugins is not publicly conveyed to everyone. Every time a plugin is delisted this should be available on a machine-readable file that is updated immediately. Why is there no direct mechanism for reporting security issues to the maintainer? (only advice to email the main plugins bucket email here https://developer.wordpress.org/plugins/wordpress-org/plugin-security/reporting-plugin-security-issues/ )

Where is the official discussion on the merits of this approach of delisting plugins? Is it really ethical to expect PluginVulns to sit on vulns when plugins get delisted without any appropriate security notification? The whole idea of mysterious “closing” plugins is very unusual to me and a core problem that is in the middle of all of this. It bugs me because it reeks of downplaying security problems which is not in the interests of users at all and it’s adding stress.

I think you’ve got to hit up these big companies and have several people stipended under an nonprofit association organization to work on a security team separate from the plugin management team. Security has to have its own sphere and a lot of this would improve.

It is really stressful to have a situation where plugins can simply vanish without notification and security is a hunt-and-peck game that is not systematized. This is one of the most stress generating things about WP community hands down. Thank you and best regards.