Points of Contact see every case and handle what supporters cannot: triage, review, publication, and user management.
Triage
Each report from the form, the API, or hex.pm opens a case at once. It waits in the Submitted column of the Cases board, and moves to the Triage column when you mark it under triage. The reporter and the maintainers hex.pm named are on the case from the start. You and the supporters on it can edit the case while you triage it. The reporter and the maintainers comment and suggest.
Hold each case against the CVE criteria and decide on the case page:
- Accept it, and it opens for filing as a draft.
- Reject it with a reason. Its open invites are withdrawn.
- Merge it into a case for the same finding. That case cites the report and takes over its people.
- Split off a new case for each further finding the report holds.
A supporter you assign to a reported case takes the same decisions on it. A merge needs them on both cases.
A reporter may withdraw until you accept. Reporters follow the outcome on the case, which their own board shows.
Review
Cases arrive in review when a supporter considers them ready. A supporter's request notifies the Points of Contact assigned to the case, so assign yourself to a case you mean to review. On a case with none assigned it notifies the Points of Contact who turned on Unassigned review in Notification settings, or every Point of Contact while nobody has. Sending a case to review yourself notifies nobody. The Cases board shows the whole pipeline.
Send a case back with your findings in the case comments, or approve it, which freezes the content for everyone but a Point of Contact. A Point of Contact still edits an approved case and accepts suggestions on it, so late detail needs no reopen. Publishing freezes the content for everyone.
Approval is judgement, not a second checklist: the record makes sense, the conventions were followed, the CVSS holds, the derived ranges match the advisory. What the CNA publishes is the CNA's decision; see the governance policy.
Publication
Publish when the coordinated disclosure allows: Varsel renders the record, validates it, and pushes it to MITRE. The OSV record, the feeds, and the hex.pm advisory data follow automatically.
Amending later means reopening the case, editing, and publishing again; the next publish reaches MITRE as an update. Fixes and improvements both qualify.
Closing and CVE IDs
Closing a case records a reason and is terminal. A case that already holds a CVE ID forces one more call, rejecting the ID at MITRE or explicitly parking it, and the answer turns on whether the ID was ever communicated outside the CNA.
Supporters take the next free ID of the year; everything else is yours: assigning a specific reserved record, a withheld ID, or one out of sequence, adopting an already-existing CVE record into a new case, and linking an upstream CVE.
Upstream CVEs
A package can vendor code from a project outside the CNA's scope, for example a C library. The CNA rules forbid the CNA to assign a CVE for a vulnerability in that code: the CNA responsible for the vendored project assigns it. Link that CVE ID to the case from Assign CVE ID instead of taking one from the pool. The ID can still be RESERVED, so a case can follow an embargo.
The case is written and reviewed as usual. Publishing adds the case's content
to the upstream CVE record as the CNA's ADP container, and sends nothing to
MITRE. The CVE page shows that enrichment, with the upstream CNA's title and
summary and a link to cve.org. The OSV record keeps the EEF- ID and names
the CVE as upstream. Validation checks the CVE schema only, so review the
conventions in full.
Publishing waits until the upstream CNA publishes the CVE: while the ID is RESERVED at MITRE, the case shows a blocker. Varsel checks the upstream record at MITRE on a schedule, so publish once the blocker is gone. Closing an upstream case unlinks the ID. Another CNA owns it, so there is nothing to reject.
People
Roles are granted under Users: new coordinators get the supporter role once they have signed in, and a change takes effect immediately, open sessions included. No email goes out on a role change, so tell the person. Case access works from the case by GitHub or Hex.pm handle and reaches people without an account via invites; granting it notifies the person in-app and by email, per their notification settings. That email is content-free, so still tell them what changed on the advisory thread. Removing someone is yours alone and sends nothing.
