Methodology

How an investigation runs

The same method applies to a slow IDE, a vulnerable dependency and a crash in a platform tracker. Each step leaves something that can be checked.

1. Find the gap. Start from evidence someone can point to: a freeze report, a published advisory, a crash in a tracker, a check that no tool makes. Reproduce it on the exact version where it happens.
2. Understand the cause. Follow it to the code that causes it: the method that spends the time, the dependency version inside an advisory’s affected range, the iteration that is not synchronized. Keep the reproduction as a test or a check that anyone can run again.
3. Build the fix. Ship the smallest change that removes the cause, with evidence before and after: a pull request upstream, a report to the maintainers, or a plugin when the fix belongs outside the platform.

Results are published with their source (the ticket, the pull request, the report or the test) and with their real status: an open pull request is shown as open, and a fix that the maintainers made in a different way is described as theirs. See the engineering evidence.