Libxml2's "no security embargoes" policy

I don't think putting the burden to fix the code should be on users. However, it also shouldn't be on developers.

I think something like "Null-pointer-referencing issues will not be looked at by core maintainers unless someone already provides a patch". That way, someone else who knows how to fix the problem can step in, and users aren't left with the false impression that merely reporting their bug will not guarantee a solution.