For security and compliance leads
Compliant, and exposed.
Remediation deadlines usually start when your scanner detects a vulnerability. For an advisory in limbo, that’s weeks after it went public. You fix it on time by your policy, and the code was exposed the whole while.
Three clocks
At October 2026’s median wait for GitHub’s review (23 days), on a 60-day axis from the day the maintainers published the advisory and the fix.
PCI DSS: within one month of the fix’s release
Your scanner tells you on day 23, with 7 days left.
Your policy: 30 days from the scanner’s alert
On time by the policy. Exposed for 53 days.
The same policy, with Limbowatch in CI
The clock starts the day the advisory is published.
SOC 2
“susceptibilities to newly discovered vulnerabilities”
Criterion CC7.1 asks you to detect them, and its points of focus include scanning and fixing what scans find “on a timely basis”. It sets no number of days: your policy does, and it usually counts from the scanner’s alert. No alert, no clock, so a fix weeks after publication still looks on time.
PCI DSS
“within one month of release”
Requirement 6.3.3: patches for critical vulnerabilities. The month runs from the fix’s release, not from detection, so the wait for review uses it up: at the October median your scanner speaks up with 7 days left, and for 44% of October’s reviews the month was over first.
PCI SSC FAQ 1597 (May 2025)
US federal agencies: BOD 26-04
“whichever comes first”
CISA’s directive of June 2026 starts the clock when the agency identifies the vulnerability on an asset, or when it’s listed in the KEV catalog, then allows 3 to 60 days by exposure and impact. Identification is the scanner’s job, so here too the clock waits for the review.
CISA BOD 26-04, Table 1
What helps
Alert at publication
Run Limbowatch in CI, so detection is the day the advisory goes public, not the day it’s reviewed. Your policy’s clock then starts when the risk does.
Keep the evidence
Each run writes JSON, SARIF and JUnit reports with dates, so you can show what you knew and when.
Track it like any finding
Limbowatch opens one issue per advisory, updates it when a CVE is assigned or GitHub reviews it, and closes it once you’ve upgraded.
Add it to your CIThe public proof repository Real packages in limbo now
How the frameworks are worded, with sources; this isn’t audit advice. Ask your auditor how they treat advisories before review. Review times from the October 2026 report; the frameworks are read in the research log, F-134 and F-156.