Responsible Disclosure section or page

[gavinandresen]

This has been on my TODO list for months, and I haven't got around to creating a pull request. So I'm going to file an issue and hope somebody else has time:

We need either a section on the Resources/Development page or a link and a separate page that answers the question "I'm a security researcher and I found a vulnerability in Bitcoin; who do I tell?"

That section/page should say something like:

Non-critical vulnerabilities can be emailed to any of the core developers or sent to the private bitcoin-security@lists.sourceforge.net mailing list. An example of a non-critical vulnerability would be an expensive-to-carry-out denial of service attack.

Critical vulnerabilities that are too sensitive for unencrypted email should be sent to one or more of the core developers, encrypted with their PGP key(s).