A drain reads only the issue ledger, so security advisories that others submit through the forge's private vulnerability reporting never reach it. Unpublished advisories are not named by any record, so nothing in abcd shows whether they were triaged. They cannot simply be copied into the ledger as issues, because the ledger is public and an advisory stays private until it is fixed; and even a ledger issue in the security category is handed back by the drain under its default rule.

A drain reads only the issue ledger, so security advisories that others submit through the forge's private vulnerability reporting never reach it. Unpublished advisories are not named by any record, so nothing in abcd shows whether they were triaged. They cannot simply be copied into the ledger as issues, because the ledger is public and an advisory stays private until it is fixed; and even a ledger issue in the security category is handed back by the drain under its default rule.

Ruling 2026-10-09

The product thinker ruled three things on 2026-10-09, after unpublished advisories on the forge were found that no record named:

1. The first drain of private advisories is run by hand, outside abcd drain, and recorded as an abcd lab: "this is an abcd lab to ensure we're on the right track". The lab is lab-261009081338-7549ca2, in the user-level lab store; its harvest lists the steps the hand-run drain did that a command would have to do.
2. Later, a separate security-advisory drain, distinct from the general drain ("a future e.g. /abcd:drain --security or similar command"), designed after a state-of-the-art check.
3. The fixes are held on local branches and land together just before the release cut that publishes the advisories.