In the event of finding a security vulnerability in the Linux world, the procedure involved would be to report the vulnerability...
- ...to the developers or the maintainers of the package in a particular operating system.
- ...to the security team of that particular operating system.
Then patches are made and CVE's are released.
I'm curious about how does open source vulnerability reporting work in the OSX world? Do the developers release CVE's if a security issue is brought to their notice?