Add section about issues not warranting an advisory

git-svn-id: svn+ssh://svn.debian.org/svn/secure-testing@54594 e39458fd-73e7-0310-bf30-c45bca0a0e42

1 files changed, 17 insertions, 0 deletions

diff --git a/doc/security-team.d.o/security_tracker b/doc/security-team.d.o/security_tracker
index d8987966a3..745b566496 100644
--- a/doc/security-team.d.o/security_tracker
+++ b/doc/security-team.d.o/security_tracker
@@ -342,6 +342,23 @@ Packages which are not anymore supported by the security team in a
             - ffmpeg <removed>
             - ffmpeg-debian <end-of-life>
 
+### Issues not warranting a security advisory
+
+This states are reserved to be used for the respective security team.
+
+Sometimes an issue might not warrant an (immediate) security advisory since for
+example an issue might be minor. When a issue does not warrant an advisory they
+are marked with a distribution tag, the `<no-dsa>` state and an explanation.
+
+Two sub-states exists: `<ignored>` and `<postponed>`.
+
+If an issue will further be ignored the <ignored> state is used.
+
+If an issue deserves an update via a security advisory, but it is not needed to
+release an advisory just because of this issue, rather than `<no-dsa>` the
+`<postponed>` state can be used. This state can as well be used, if a fix is
+already queued up for a future security advisory and it will be included in
+such.
 
 ### `NOTE` and `TODO` entries