We look at what makes a security issue critical and how upstream developers and vendors respond by examining three incidents: CVE-2013-0156, CVE-2013-0333, and rubygems.org. Moreover, we look at improvements that can make security better in the future – specifically, incident response handling.