# OpenSSL vulnerability disclosures

- **Series role:** reporting control and fixed-codebase comparison
- **Metric:** official OpenSSL vulnerability disclosures per quarter
- **Coverage:** see `summary.json` and the central observation store
- **Data through:** the latest committed official CVE record
- **Upstream:** official `openssl/release-metadata` snapshot; the exact commit is recorded in `raw/openssl-secjson.json`
- **Current status:** monitoring; descriptive change only; causality unresolved

## What this series measures

OpenSSL maintains one official JSON record per disclosed CVE. This indicator counts one record in the quarter of its public date. Missing quarters remain in the data as explicit zeros.

The series measures **public disclosures in one fixed software project**. It does not measure every vulnerability that exists, the amount of research effort, or scientific progress as a whole. Its value is comparative: it gives the tracker a second independently maintained codebase beside curl.

## Snapshot facts

`summary.json` is the current source of truth for record counts, annual and quarterly totals, severity, attribution bands, coverage, and the latest partial period. `check.mjs` independently recomputes those facts from the raw snapshot and checks them against the central observation store and registry. The final period is never silently annualized.

## Severity and attribution

OpenSSL records its own severity assessment in each modern CVE record. The current severity and attribution counts are generated in `summary.json` and independently recomputed by `check.mjs`.

The four credit-text bands are mutually exclusive:

1. `explicit_ai_marker`
2. `ai_affiliation_only`
3. `fuzzing_marker`
4. `other_or_unmarked`

The broad AI numerator combines the first two for continuity with the public quarterly panel. This is intentionally noisy attribution evidence. A credit can omit AI use, and an affiliation can appear even when a model did not produce the finding. Current counts belong in `summary.json`.

Older OpenSSL records do not always contain a modern severity field. Those records remain `unknown`; they are not silently reclassified. Severity comparisons therefore work best within periods that use the same reporting format.

## Rebuild and audit trail

The panel has one canonical raw snapshot:

```text
raw/openssl-secjson.json
```

`fetch.py` supports three modes:

```sh
# Fetch the current official branch, vendor a new snapshot, and rebuild
python3 series/openssl-vulnerability-disclosures/fetch.py

# Rebuild every derived table without network access
python3 series/openssl-vulnerability-disclosures/fetch.py --from-snapshot

# Fail only when the official upstream has moved
python3 series/openssl-vulnerability-disclosures/fetch.py --check-upstream
```

The rebuild creates:

- one normalized audit row per CVE in `records.json`;
- a severity and attribution summary in `summary.json`;
- the compact quarterly rows in `data/series-observations.json`;
- synchronized coverage and source metadata in `data/series.json`.

`check.mjs` independently recomputes the quarterly counts, severity bands, attribution bands, coverage, and source metadata from the raw snapshot.

## Analysis status

`data/analysis-specs.json` contains a draft descriptive specification. It uses quarterly counts, quarter effects, and an exposure adjustment for the incomplete final period. curl is retained as a separate fixed-codebase comparison.

January 2025 is only a descriptive marker because broad AI-marked reporter credits first appear in this series during 2025. It is not treated as an exogenous intervention. Search effort, incentives, release timing, project policy, and disclosure practices remain plausible alternative explanations.

## Limitations

- There is no denominator for research effort, submissions, model calls, inference compute, or search time.
- OpenSSL disclosures can arrive in release-related batches.
- Reporter credits are incomplete and noisy evidence about the method used.
- More disclosures, especially Low-severity findings, need not imply greater security value.
- The latest period may be incomplete; its end date is recorded in `summary.json`.
- A repeated pattern across curl and OpenSSL is stronger descriptive evidence than one project alone, but common non-AI causes can move both.
- Two software projects are not representative of science.

## Methodological inspiration

The fixed, rebuildable outcome series and the separation of counts, quality, attribution, and causal status were inspired in part by METR's [“LLMs' Contribution to Discoveries”](https://metr.org/notes/2026-08-14-llm-contribution-to-discoveries/) and Thomas Cunningham's public [`ai-discovery-data`](https://github.com/tecunningham/ai-discovery-data) repository.

This tracker keeps its own schema, fetcher, snapshot, checks, analysis status, and public presentation. The data are rebuilt from OpenSSL's official repository rather than copied from the reference project.