I have mixed feelings here as a Tailscale customer.
Yes a quick response is great, but this actual security issue is pretty terrible IMHO.
Anything other than an immediate response would have been akin to lighting their company on fire and walking away.
Have we forgotten Zoom, who reinstalled itself secretly on user machines with an RCE-vulnerable server, which they described as “working as intended?” They’re still wildly popular today with organizations despite the insane lack of regard for security and their users’ safety.
Mistakes happen. I applaud Tailscale for moving so quickly and doing the right thing.
[1]: https://notes.acuteaura.net/posts/github-enterprise-security...
Companies get away with sweeping customer security issues under the rug less and less, but still far too often. I honestly wish we as a people would put other players of this game in as high standards as you do here for this company here.