A public signal with a short embargo.
The first completed v0.2 scan is public. Critical-finding details are temporarily withheld from public report views for 30 days from scan time.
What the public sees
During the 30-day period, public reports identify a critical finding but replace its title, description, remediation and source location with a disclosure notice. After 30 days, the current application may reveal those details automatically. Other findings and summary data remain visible.
What this does not provide
This is a display rule, not a coordinated disclosure service. GAAAS does not currently guarantee maintainer notification, a review window extension or manual approval before the automatic reveal. A person who initiated a scan is not necessarily the repository maintainer.
Ask for a review
If a finding is inaccurate, especially sensitive, or associated with a repository you maintain, send the report URL and relevant context through the support form. Do not include exploit details or secrets in a public URL.