Providing a list of security-related bugs

[michaeleisel]

When deciding whether or not to update my version of simdjson in ZippyJSON, one of the big factors is security. I'm not necessarily interested in new APIs or features, but I want to make sure that the version I use is as secure as possible. That said, I don't want to upgrade every time if I can help it (and also risk encountering new bugs). It would be great if there was a list somewhere of simdjson's security-related bugs, e.g. buffer overflows, the version they were fixed in (if fixed), and the version they were first introduced (ideally). It would help me decide when to upgrade my version of simdjson.

[lemire]

That’s a great idea. Would someone volunteer to manage such a database?

[jkeiser]

Given the number of them, I imagine someone could skim the notes for each release and make a pretty short document. I only remember finding one really obscure security bug in the past 3 years, but I imagine I've forgotten one or two others.