Redmine

There should be a security email list that users can send mail to about potential security bugs. This email should be added to the wiki and the orange warning box when opening a new issues on Redmine.org

Ideally, this could even be linked to a private project on Redmine.org so security issues can be worked in privately and then moved ("released") into the main Redmine project once a valid patch is ready.