Good nits, @nrc 
you might want to change hours/days to working hours/days
Yeah, this is a good point. I know I personally would consider it to be just days, but depending on who is actually on the team, working days may be better.
How are security bugs tracked? Presumably they won’t be in public GH issues. Who has access to security bugs?
The individuals who monitor said list have access, as effectively, the emails are the tracking. We’re expecting to address these issues right away, rather than have them sit around for a long time. A compiler operates quite differently than a project like Firefox. We’ll see, though.
Sounds too strict to me.
I can’t actually remember, but last I remember, we’re not explicitly maintaing previous releases of Rust yet. Since 1.x releases are a drop-in upgrade, we expect the vast majority of users to be on the latest. That said, obviously it won’t be 100%, and there’s lots to consider here.
This sounds wrong, unless the security team is larger than I am expecting.
See the above Twitter thread with Jacobian for a good argument for having some sort of pre-disclosure list. I chose no disclosure at first because it’s not even clear that we will have any candidates for pre-disclosure for a while, as the usual suspects are people like Linux distros. I’m not categorially opposed to a pre-disclosure list, but starting off simpler seems prudent, or at least, that’s my line of thinking.
