Vulnerability Reports Are Not Special Anymore

This article discusses how the role of vulnerability reports in open source has changed with the rise of LLMs. The author, a former Go Security team lead, explains that traditionally, vulnerability reports were treated as special because security researchers provided scarce insight and confidentiality. However, by 2026, LLMs have democratized vulnerability discovery, making insight non-scarce and triage the new bottleneck. The article argues that external researchers can no longer meaningfully contribute to triage, and confidentiality matters less as attackers can also use LLMs. The focus should shift to triage, rapid remediation, and prevention, including running LLM analysis in CI.