How many sources of advisory data should we have?

[jasnow]

Currently we have primarily one - the "global" GitHub Security Advisory web site (GHSA): https://github.com/advisories.

[jasnow]

Found this article with this statement yesterday:

• GHSA's "Processing times extended first to about a week, then to multiple weeks"
  • https://github.blog/security/supply-chain-security/inside-the-advisory-database-and-what-happens-when-vulnerability-volume-breaks-records

[jasnow]

Found this article yesterday:

• Title: Inside the Advisory Database and what happens when vulnerability volume breaks records
  • https://github.com/orgs/community/discussions/189802I