"The Koha community has the following procedure posted: https://koha-community.org/security/. Essentially, they define a Security Team of release managers/maintainers and other folks known in the community (many of whom have assumed those roles in previous releases). Issues are filed into a separate project, presumably with tighter access controls. Once the fixes are made, they're backported into all supported releases, and the community is notified to install the latest updates to their current version."
???
Security Issues - Releasing fixes
All
There were a bunch of security issues created last week, w/ varied priority.