Write Runbooks for Addressing CVEs

[noelmiller]

When dealing with #553, I noticed we did not have a defined plan for dealing with CVEs. I think it would be valuable to have a runbook on how to address CVEs.

I think we should also include information in the contributing guide about how to responsibly disclose CVEs to the team.

Rough information that should go in the runbook: (thanks @bsherman)

1. create a "war room" thread in #ublue-dev
2. pause all dev work (PR merges, extraneous Github builds) until CVE is handled or agreed to allow parallel efforts
3. coordinate to write our own announcement
4. test images/builds as needed

[dosubot]

Hi, @noelmiller. I'm Dosu, and I'm helping the Main Repos team manage their backlog. I'm marking this issue as stale.

Issue Summary:

• The issue highlights the need for a runbook to manage CVEs due to the lack of a structured approach.
• Suggested actions include creating a "war room" thread, pausing development, coordinating announcements, and conducting build tests.
• It also proposes adding CVE disclosure guidelines to the contributing guide.
• There have been no comments or further activity on this issue.

Next Steps:

• Please let me know if this issue is still relevant to the latest version of the Main Repos repository by commenting here to keep the discussion open.
• If there is no further input, the issue will be automatically closed in 14 days.

Thank you for your understanding and contribution!