Black October: a security filter switched off by a name

Takeaways

• Finding vulnerabilities and fixing them has scaled with compute access to GPUs and Frontier APIs.
• When an endpoint picker and a filter share a name, a single header can skip policy. The fix is simple: don't give them the same name.
• GitHub is now rate-limiting the vulnerability reports, creating a platform barrier between consumers and maintainers.
• Writing the fixes took way less time than the entire process of coordinating a disclosure.