[Marco van Herwaarden]

Staff don't know if a modification is vulnerable until a member reports the issue to us. Once reported a staff member will check the code to verify if there i a vulnerability. If it is confirmed, the modification will be quarantined until staff does not spot any vulnerabilities. Depending on the size of the modification this can be a long process as we have to manually go over all the coding and see if we can spot any vulnerable coding. And once it has been corrected by the author, we will need to do another check to see if everything is resolved. This is not something that can be done in a hurry. Very often a modification that has 1 vulnerable part of code, also will have more issues. But we only know that after we went over all the (new) code again. And yes, this is much easier if the same person who did the first check (and knows best what he found), does the 2nd check. In cases like a weekend or holiday, this can take a bit longer then normal but is really needed to ensure the quality. If the handling staff member is offline too long, then another staff member will take over, but we prefer to have it handled by a single person.