Possible initiatives and things we've discussed doing as part of the work for this meeting.  In no particular order

• Make sure our users know what they should be doing to find out about updates, EOL, CVEs
• Consider if projects that are not releasing regularly are really healthy.  Could they realistically respond to a security vulnerability in a reasonable time frame?
• Have a better EOL policy with defined communication routes, policy for CVE in EOL releases.
• Look again into SCR:CLR as a service to projects