Original discussion: https://github.com/nodejs/security-wg/pull/954/files#r1179651456 @mhdawson > There MUST be no unpatched vulnerabilities of medium or higher severity that have been publicly known for more than 60 days.