Security bug policy

Hi,

where can I find an updated security bug policy?  It seems that it's
been decided that crash bugs are not worth releasing advisories for,
but I couldn't find any confirmation.

Florian