...
- Public releases and announcements are made at an agreed upon time, ideally 1-2 business days after the notification to vendormailing-seclist:distros.
- Tarballs are prepared "in secret" without committing anything to SVN or discussing on a public list.
...