I really think that crates.io needs a way for crate authors to independently publish advisories without having to go through advisory DB: it's a bottleneck. I can understand that that bottleneck helps to dissuade overzealous publishing of advisories for trivial matters, but I don't think that's an acceptable reason to not have a maintainer-driven system too.

#rustlang