Development record

Once a security advisory's fix has shipped, its text goes public exactly as it was drafted. A draft is written while the finding is being worked, so it can carry detail that a published advisory doesn't need: source paths and line numbers, reproduction steps, local paths, hostnames or member logins. embargo publish already leaves out an advisory whose text carries a secret, a private name or another embargoed id. It does not summarise the text first, and it does not run the wider privacy checks over it.