Rules security response procedure

[jsharpe]

For google 'owned' rules there is a google owned process for disclosing issues in OSS projects, however I suspect this SIG will cover rules that are wider than the scope of Google's ownership.

Should this SIG own a coordinated disclosure procedure for rules that are curated by the SIG?

The ossf has this guide which might be useful:
https://github.com/ossf/oss-vulnerability-guide/blob/main/guide.md