"Do all security vulnerabilities need to be fixed in private?"
https://openjsf.org/blog/sovereign-tech-agency-invests-in-openjs-to-rethink
OpenJS FoundationSovereign Tech Agency Invests in OpenJS to Rethink When Vulnerabilities Should Be Fixed in the Open | OpenJS FoundationResearch using Node.js will classify vulnerabilities by risk, then test whether some security issues can be fixed through normal open source development instead of behind closed doors