The OpenJS Foundation today announced an investment from the Sovereign Tech Agency (STA) to test a fundamental assumption in open source security: Do all security vulnerabilities need to be fixed in private?

The project comes as AI is dramatically increasing the speed and volume of vulnerability discovery. Multiple researchers, and increasingly multiple AI systems, can independently discover the same issue at nearly the same time, creating duplicate reports and additional work for maintainers. 

Using Node.js as the primary real-world research environment, OpenJS will measure whether classifying vulnerabilities by risk and moving some into normal, transparent development can speed remediation and reduce the burden on maintainers without increasing security risk.

“AI is changing how quickly we can find vulnerabilities, and that creates an opportunity to rethink how we manage them,” said Robin Bender Ginn, Executive Director of the OpenJS Foundation. “We want evidence about where confidentiality protects users and where working in the open could help us fix vulnerabilities faster. This research could help drive a real culture shift in open source security.”

Research First, Not a Predetermined Answer

The research does not assume that vulnerability handling should become either more public or more private. Instead, the first step will be developing a versioned classification framework to determine which classes of vulnerabilities may be candidates for public remediation and which must remain confidential. AI-assisted tooling will help identify duplicates, classify reports and recommend a public or private track, while human maintainers retain the final decision.

Before changing how any vulnerabilities are handled, OpenJS will conduct a shadow evaluation of the classifier. It will then run a controlled Node.js pilot comparing eligible vulnerabilities fixed through normal open development with vulnerabilities following the existing private security process. If defined safeguards are triggered, vulnerability classes can be returned to private handling.

Researchers will compare the two approaches primarily by measuring the time from report to released fix across all active versions. They will also track duplicate reports, triage and remediation time, maintainer effort, review activity, and any instances of unintended early disclosure. The aim is to produce evidence showing where working in the open improves security outcomes — and where confidentiality remains necessary.

“We’re seeing the same findings discovered again and again with widely available AI tools. If a security issue can be reproduced on demand, we need to ask whether keeping it private actually makes us safer,” said Rafael Gonzaga, Principal Open Source Engineer at NodeSource, Node.js TSC Vice-Chair, and OpenJS research lead for the project. “This research gives us a chance to test whether some issues can be fixed faster in the open, while preserving private handling for the vulnerabilities that truly require it.” 

The €115,000 investment supports four areas of work: AI-assisted vulnerability classification and tooling, a controlled Node.js pilot, measurement and analysis, and public guidance and ecosystem adoption.

From Node.js Research to Open Source Practice

OpenJS will publish the research methodology, results and implementation guidance, including reusable guidance for vulnerability classification, AI-assisted triage, human review, security safeguards and measurement. The goal is an approach other open source communities can adopt directly, rather than each project solving the same problem independently. The project will also convene a public workshop to share findings and identify opportunities for adoption and further research beyond Node.js, JavaScript and OpenJS.