Linus&#x27;s law applies (if it&#x27;s even true, which there&#x27;s insufficient empirical evidence for) to code, not bug trackers. The kernel&#x27;s reporting process for security bugs involves sending an email to security@kernel.org, a closed list with secret membership. It may also involve sending an email to the linux-distros@openwall mailing list, which is also closed but has public membership (and is run by a third party). If either of these groups has a bug tracker at <i>all</i>, they haven&#x27;t told anyone else.<p>And unlike Mozilla&#x27;s policy, at no point is the history of discussions on either security@kernel.org or linux-distros@openwall <i>ever</i> opened up to the public. Fixes can, and are often intended to, show up in the kernel changelog without any mention of what security issue they fixed.