Regarding CVE-2026-115731 and CVE-2026-115732, the OpenVox advisories credit an external researcher, alain-neodyme, with reporting both issues. Could the Puppet team share more about how they were discovered and how the coordinated disclosure process worked? Given the security rationale presented for the move to a proprietary development model, how is Perforce measuring whether that change is delivering the intended security benefits, particularly around vulnerability discovery and remediation?

For these two particular CVEs, the vulnerabilities were responsibly reported by an external security researcher with Neodyme. The public KB article here does have some additional details beyond the public messages that were sent out, but it does not address the reporting / remediation process: Puppet security vulnerabilities: CVE-2026-115731 and CVE-2026-115732 Because of the sensitivity of the situation, we have been asked to direct folks to open specific requests for more details through the customer support portal. All public channel discussions in this Slack are backed up and published publicly to Linen, so this discussion would be best via the support channel. You can open a support case and reference the CVE ID in the subject here: portal.perforce.com/s That way the security team can be involved, along with any other folks that can help provide the details you need.