OpenSSH bug falls through the cracks

Is it worth having a central list of security contact details and bug submission procedures
for open source projects? Such information doesn't change often, and it might avoid the "I
emailed the project lead" problem.