When More Data Means More Work: Inside GitHub’s Vulnerability Curation Bottleneck
A security database does not slow down because something is broken. It slows down because every new report that arrives might be accurate, might be incomplete, or might contradict two other sources — and someone has to figure out which before any automated tool can act on it. That tension between volume and verification is exactly what GitHub’s Advisory Database ran into this spring, and the story is worth understanding not as a company hiccup but as a window into how security infrastructure actually works.