> If there’s a CVE the foundation should orchestrate reporting and standardize it. to some degree that is the case. There is rustsec CVE numbering agency, and

> If there’s a CVE the foundation should orchestrate reporting and standardize it. to some degree that is the case. There is rustsec CVE numbering agency, and crates.io on their website list CVEs reported to it under the `Security` tab. In combination with cargo-audit, cargo-deny and co this is already quite useful. But IMHO as of now things don't yet fully "click together"/"work out of the box" and many IMHO needed parts are still missing.