@dalias @ska I think that the vendor of the appliance has good intentions, but there are intended consequences.
Unfortunately those unintended consequences can be long lasting, and encumber progress.
For some run-of-the-mill bugs where the most likely worst case is a crash (which can be detected), I question if we need to go to the trouble of issuing a special "security bulletin", rather than just keeping a detailed changelog / commit message.