# Sarah Jamie Lewis announces her candidacy for the Major Grants Review Committee **URL:** \ **Category:** Governance\ **Created:** [May 16, 2020, 1:55am UTC](https://forum.zcashcommunity.com/t/sarah-jamie-lewis-announces-her-candidacy-for-the-major-grants-review-committee/36516 "2020-05-16T01:55:07Z")\ **Posts on this page:** 1\ **Showing post:** 71
**Author:** ![sarahjamielewis](https://sea2.discourse-cdn.com/zcash/user_avatar/forum.zcashcommunity.com/sarahjamielewis/32/15152_2.png) [@sarahjamielewis](https://forum.zcashcommunity.com/u/sarahjamielewis)\ **Post date:** [August 25, 2020, 4:43pm UTC](https://forum.zcashcommunity.com/t/sarah-jamie-lewis-announces-her-candidacy-for-the-major-grants-review-committee/36516/71 "2020-08-25T16:43:20Z")
> [@dontbeevil](#): > > in retrospect, do you agree that opening a github issue or notifying the developer directly before tweeting out details about vulnerability is the right thing to do? As I’ve stated numerous times in this thread, this was a trivially exploitable 10 hour-old MITM exploit in a cryptocurrency project - I believed then, and I believe now, that warning users about the risk was more crucial than getting the actual issue fixed. In an ideal world, the presence of such an issue should be enough to call into question the entire risk assessment of the project. We still don’t have a root cause analysis behind why such a version of the wallet with such a critical issue was released (or any idea of the actual vulnerability window i.e. downloads of the vulnerable version v.s. the update). If we want to talk about _actual_ risks to Zcash users then we need to look there. To use an imperfect analogy: If I found a fire in a building, my first action would be pull the alarm and get everyone out of the building, to safety, not to call the building owner. --- _[View the full topic](https://forum.zcashcommunity.com/t/sarah-jamie-lewis-announces-her-candidacy-for-the-major-grants-review-committee/36516)._