For General Users
A simple form that CCs its submission to the relevant developer and the moderators could suffice. After reporting issues, users could be “debriefed” to ensure they understand what to do (and what not to do) after they report. The moderator could also email the developer, to connect the dots (i.e, make sure the message was received,) and a plan of action can be shared with the moderator at that time
We’re working on a fix and expect a patch to roll in 72 hours.
Responsible disclosure for developers (about their own plugins) could probably be handled in the same way. Once the fix was implemented, you would also want to see a non-vague note in the changelog about the specific issue being fixed. For developers that attempt to hide or otherwise obscure an issue, I’d probably hit them with a pretty harsh penalty as that behavior would greatly erode trust in the ecosystem.