Thanks for pointing this out, I've never heard about this model before. Sounds quite reasonable to me. The only problem I see is if they treat all requests equa

Thanks for pointing this out, I've never heard about this model before. Sounds quite reasonable to me. The only problem I see is if they treat all requests equally. I'd be concerned if security related PR get cancelled because the submitter is not subscribed. From my understanding they do pre-screen submissions before cancelling so that shouldn't be the case (at the price of creating some overhead for them).