Consensus: Security Hall of Fame, Security issue attributions, NEWS, and Contribution Checklist.

[Roland McGrath]

> Rather than the suggested NEWS section I'd rather say that each bug with a 
> CVE gets its own entry in the NEWS file (in addition to the general list 
> of fixed bugs) and that those entries credit the reporter.

That sounds proper to me.  There would be nothing wrong with making each
release's NEWS page group all the CVE bugs together with a heading.