I had to disconnect from yesterday's call before the QEMU security discussion. As a starting point, perhaps Justin and others can refer to:
- https://wiki.qemu.org/SecurityProcess (QEMU security process)
- https://oss-security.openwall.org/wiki/mailing-lists/distros (linux-distros mailing list, which is how QEMU contacts downstream vendors)
and ask for clarifications and missing points.