Security vulnerability disclosure policy

[dcermak]

Would it be possible to communicate the disclosure/release of security vulnerabilities ahead of time privately to maintainers from other distributions so that we can release security fixes quickly?