Subject: security vulnerability disclosure procedure?

From: Richard Hansen <[email-masked]>
Date: Sun, 20 Apr 2014 16:42:09 -0400

Hi all,

I have discovered a minor security vulnerability.  I could send the
patch to the mailing list, but I wanted someone else to take a look
first just to make sure it's minor enough that folks will think it's OK
to publicly announce.

Who should I send the patch to?

Thanks,
Richard