The Link Isn't the Danger

A few years ago, one of the worst software vulnerabilities in memory went public. It was called Log4j, it lived in a piece of software that half the internet quietly runs on, and for about a week everyone in the industry was scrambling to find out whether they were exposed and patch it before anyone got in.

I was working with a client at the time, and I sent the owner the link to the official writeup so they'd know what we were dealing with. The reply came back fast and alarmed: we can't share that link, it's unsafe.

I understood the instinct completely, and it was exactly wrong. The link wasn't the danger. It was the opposite of the danger.

A CVE is a recall notice

The thing I'd sent was a CVE: a public, numbered, official entry in a global list of known software vulnerabilities. They look like CVE-2021-44228, a year and a number, and there's a searchable database of them that anyone can read.

The best way to think about a CVE is a recall notice. When a car company discovers a defective part, they don't hide it. They issue a public recall, with a number, describing exactly what's wrong and what to do about it, and they want it spread as widely as possible, because the whole point is to reach everyone driving that car so they can get it fixed. The recall notice isn't the danger. The defective part is the danger. The notice is how you find out you have it in time to do something.

A CVE is that, for software. It isn't the vulnerability. It's the announcement of the vulnerability, published on purpose, so that everyone running the affected software can check whether they're exposed and patch it. Sharing it with your developer is precisely the right move. It's handing your mechanic the recall notice.

Secrecy isn't security

The deeper thing the "keep it quiet" instinct gets wrong is the belief that a vulnerability stays safe as long as few people know about it. It doesn't, and here's the uncomfortable reason: the attackers are not waiting on the public announcement. By the time something is published as a CVE, the people who would exploit it are often already looking for it. The bad guys don't need the press release.

So keeping the news quiet doesn't slow them down at all. It only slows down the defenders, the people running the software who need to know they're affected so they can fix it. Silence helps exactly the wrong side. This is why "security through obscurity," hoping you're safe because nobody's noticed the hole, is a punchline among people who do this for a living. The hole is the risk, whether or not anyone's talking about it. Talking about it is how the good guys catch up.

How it's actually supposed to work

There's a whole careful process behind these announcements, and it's genuinely reassuring once you see it. When a researcher finds a serious flaw, the responsible path isn't to publish it immediately or to sell it. It's to quietly tell the people who make the software first, privately, and give them time to build a fix. Then, once there's a patch available, it goes public as a CVE, so everyone else can apply the fix.

That's coordinated disclosure, and it's most of why the internet works at all. An enormous, largely invisible system of researchers, vendors, and public databases is constantly finding problems, fixing them, and announcing them so the rest of us can keep up. The scary-looking link is a product of that system doing its job.

What to do when your developer sends you one

So when someone on your side sends you a CVE, they are not exposing you or spreading something dangerous. They're doing the single most useful thing they can: telling you that you might be affected, while there's still time to act.

The right response isn't to hide it. It's two questions. Are we affected by this one? And if so, how fast can we patch? That's the entire correct reaction, and a good developer will already be chasing both answers by the time you ask.

The danger was never the link. It's the unpatched thing sitting quietly behind it, the thing you'd never have known to fix if nobody was allowed to talk about it. A CVE in your inbox is good news wearing frightening clothes. It means someone caught the problem, and told you in time.