I feel there should be some process for reporting security-sensitive issues
in GHC -- for example, #9562 and #10826 in Trac. Perhaps something like the
SensitiveTicketsPlugin [3] could be used?