FYI, I've added a page to the website for "Security Reports", based on the one used by Tomcat:
http://incubator.apache.org/openofficeorg/security.html Just the basics right now, including how to report an issue. Note that at the end I also give a pointer to the legacy openoffice.org security bulletins. -Rob
