How are pulumi security vulnerabilities announced?

In general, we follow a process much like AWS's: https://aws.amazon.com/security/vulnerability-reporting/. We don't have this documented yet on our website, however, and we don't yet have a specific security bulletin "channel" (or blog tag). I've opened up https://github.com/pulumi/docs/issues/1523 to track doing so. Any vulnerability would also get posted to #announcements.

Ok got it. Thanks Joe.