Most of the critical reports have been quickly verified by project owners, Calle said, and are being reproduced using a working proof of concept in a local test environment before being sent.

But he acknowledged the volume is creating problems of its own.

“There’s a lot of chaos right now in the ecosystem,” he wrote, apologizing to maintainers buried in reports and saying the group is still learning to sort out “the slop.”

The group publishes fast because maintainers can now verify findings almost for free using the same tools, Calle said, and because “others who aren’t on the red team will arrive at the same findings as we did.”