Disclose via confidential issues instead of email
In keeping with the spirit of our own blog post https://about.gitlab.com/2016/03/31/feature-highlihght-confidential-issues/ , we should follow this disclosure process.
\cc @balameb @sytses @rspeicher @DouweM