As part of security training I saw an Incident Response Plan (IRP), and having such seems very helpful scaffold when responding to a vulnerability report.
This issue is mostly a placeholder for now, pending getting access to an example IRP that could be used to model a Jupyter wide IRP or subproject specific IRP.