The OpenSSL project has unveiled its first security policy on how the project will handle security fixes, and to whom it will disclose vulnerabilities prior to releases.