Our fuzzers run continuously on ClusterFuzz and bugs are embargoed for 90 days. We have a significant backlog and we've allowed some of the non-critical fuzz bugs (functional vs. security related) to age out past the embargo. These can be seen at:

https://bugs.chromium.org/p/oss-fuzz/issues/list?can=2&q=envoy

This GH issue is intended to remain open for anyone interested in tackling an issue here. Most of these are great starter bugs, usually requiring a small PR to fix configuration validation or the integration test framework.