[Marco van Herwaarden]

I know the old policy was to ask the author to fix a hack, and then only after they didn't (for a very long time in some cases) would it get either fixed by a staff, or have the files removed (but left in place, not zoomed off to a graveyard).

Okay, let me focus into some of these:
- The policy itself has never been changed, but as the site is changing the practical implementation might have undergone some (minor) changes.
- It has always been the policy that if a severe (read: dataloss/datamanipulation for users) vulnerability is found, it will be made unavailable immediate and users/author notified.
- We have removed the part about non-severe vulnerabilities (which did have a 7-day grace period) as it turned out that this was hardly ever the case. Almost all discovered vulnerabilites where in the 'severe' category.
- Previously we did not have a Graveyard, so the next best option was to remove the file. This however ment that the file was also not available anymore to staff for a review of the vulnerability. By moving to the graveyard instead, we still have the original thread with attachments. i see this as just a better implementation of the same policy.
- Additional benefit of this (and yes i know some will claim this is not a benefit) is that the thread is also closed for discussion. What we had a few times when we only removed the file, is that members would start a discussion on the vulnerability itself, giving out a lot of information that could be abused, or provide partial solutions giving other users a false sense of security.
- A staff member might (this will ahrdly ever happen) provide a fix. This has always been in our policy.

Some may say that the above is a change in the policy, personally i do not see it that way.

I hope my answer give you a bit more insight now in things.