How to triage security reports

There's slop coming, but also a lot of medium-to-high quality reports. Maintainers are going to have to know how to triage security reports.