Define communications strategy (blog posts, social media posts...) after a CVE is released

[mx-psi]

For CVE-2024-36129 we also published a blog post to spread the word and provide further ciontext about a vulnerability. This may be a good practice (specially for High/Critical security vuilnerabilities). Having a guideline about the content and timing of such blog posts as well as when they are advisable would be helpful.

[jpkrohling]

I'll work on a paragraph for this as part of "Fix Disclosure Process" once we sort out #61 .