Code review for security advisory coverage applications

Hello Everyone,

I talked with a few Git admins about organizing an application review sprint to occur during the Drupal Global Sprint Weekend (https://groups.drupal.org/node/447258). This would be a virtual sprint, so all locations are welcome. The main purpose of the sprint would be to help reduce the RTBC backlog.

We would need Git admins on-hand to approve users, and any non-admin volunteers to help however they can. Of course, I don't consider the exact details up to me. We'll need a person or two to help organize/spearhead efforts.

If we have promoted a user with the git vetted user role and find security issues in their code afterwards we should not remove the git vetted user role. This can always happen and we have a process to deal with security issues.

If the project has no stable release yet please report the problem as critical issue in the public queue.

If the project already has a stable release please please report the problem with the "Rport a security vulnerability" link on the project page. That will create a private issue on security.drupal.org where the coordination with the security team happens.

As of this morning, there are only 80 issues in needs review and 70 marked as RTBC. Of those in RTBC, none of them are older than three months. Of those in the needs review status, only one has a creation date of over a year. (There are many reasons that go into why project applications take a long time; which include volunteer reviewer availability and responsiveness of the person applying.)