Public feedback/retrospective thread about Drupal security process

Security releases are a tricky problem, for basically all organizations. They present extra challenges in internet-facing software, used around the globe, and supported by an open source community that's a mix of volunteers and paid or partially funded people. Feedback in Drupal is basically always welcome, whether as an issue in a queue, a comment on social media, a presentation at a meetup/camp/conference, or some other channel. In the spirit of constant improvement, I'm posting here to explicitly solicit feedback about what elements of the Drupal Security process could be improved.

The security process can be thought of in the lifecycle of a security bug:

• Bug introduced into the software
• Bug released in a package that gets installed
• Bug is identified by someone (often someone who is not on the Drupal Security Team and often not even a registered member of Drupal.org)
• Bug is reported to the Drupal Security Team
• Bug is worked on in private by a mix of the reporter, code maintainers, and Security Team members
• Announcements are written and coordinated
• Git commits made, release made, announcements published
• Sites update all the code

There are potential problems and points of friction throughout this process and I think the Drupal community has done a lot of work over the years to improve the flow. That's great! But still: there is room for improvement, so let's discuss problems and potential ways to improve in comments below.