How VIR Community actually works

No marketing speak. Just the workflow from "I want to publish a mitigation" to "It's live in VIR's canonical CVE catalogue with my name on it."

The mitigation publishing pipeline

1
Draft
Open /m/propose. Paste the CVE-ID. Write a summary, the body (markdown), affected versions, code blocks (fix / workaround / verify / rollback), references. Save draft anytime.
2
Submit → AI review
Two independent AIs (Claude + GPT-4o) score your proposal 0-100 on technical correctness, safety, completeness. Median wins. Score drives the next step.
3
Routed by score
<50: returned to author with suggestions. 50-69: 2 staff reviewers required. 70-89: 1 staff + 1 Trusted member. ≥90: fast-track, 1 staff reviewer.
4
Human review
Reviewers see your draft + the AI scores + history. They can approve, return-for-edit, or reject (with reason). Decision is Ed25519-signed and added to the audit chain.
5
Published to VIR
On approval, your mitigation is signed and posted to VIR's /admin/mitigations with source_tier='community-verified'. It appears on the canonical CVE detail page within seconds, attributed to you.
6
7-day silent objection window
Anyone in the community can flag your published mitigation during the first 7 days. After that, it's permanent. If flagged + reviewers agree, it's retracted (cascades to VIR via webhook).

1
Drop a report
/m/disclose. Vendor, product, version, type of vuln, impact, suggested mitigation. PGP-sign if you want.
2
CNA routing
We figure out whether the right CNA is the vendor (Apple PSIRT, MSRC, Cisco), upstream (kernel.org), GitHub Security, or MITRE. Routed automatically.
3
Coordinated handling
You get email updates at each step. Embargo respected. Vendor patches. CVE-ID assigned.
4
Published with credit
When embargo lifts, the CVE lands in VIR with your name on it. Permanent public record.