Centralized Security Reporting for Open Source

In a community as widespread and decentralized as open source, how do you coordinate information about software vulnerabilities?