Document hotfix protocol

docs/publishing.md

@@ -42,3 +42,16 @@ With each pull request, the @MetaMaskBot will comment with a build of that new p
 4. Publish to [Opera store](https://addons.opera.com/en/extensions/details/metamask/).
 5. Post on [Github releases](https://github.com/MetaMask/metamask-extension/releases) page.
 6. Run the `npm run announce` script, and post that announcement in our public places.
+
+## Hotfix Differences
+
+Our `develop` branch is usually not yet fully tested for quality assurance, and so should be treated as if it is in an unstable state.
+
+For this reason, when an urgent change is needed in production, its pull request should:
+
+- Describe it as a hotfix.
+- Use a hotfix tag.
+- Should be proposed against the `master` branch.
+
+The version and changelog bump should then be made off the `master` branch, and then merged to `develop` to bring the two branches back into sync. Further time can be saved by incorporating the version/changelog bump into the PR against `master`, since we rely on @MetaMaskBot to run tests before merging.
+