As more and more devices become connected, security of these devices is becoming more and more visible. With an increase in governmental standards regarding security of devices sold to consumers, the security of devices built using Zephyr is becoming ever more important. David and Flavio are the security chair, and architect for the Zephyr project. This talk will give an overview of our security journey, so far, what is being done now to improve the security of the project, and where we hope to go. The focus will be on the idea of a security vulnerability: what happens when a vulnerability is reported, how it gets fixed, tracked, and who is notified and when, ending with the public disclosure through the CVE system.