At our #curl maintainer meeting tonight we decided to move forward with the "handle LOW/MED vuln reports openly on GitHub".
Now we just need to get the documentation and processes adjusted, then push the button to do this. Maybe write a blog post too. So, ideally within this week.
Stay tuned