gitlab-roadmap.md

@@ -153,4 +153,18 @@ On being user-friendly, this is indeed a big challenge, no matter what. Currentl
 
 Note that currently there is no "core" project (todo). Ideally, each of those projects should have a clear description. The list should not be too long.
 
-By comparison, JIRA has a lot of very powerful but difficult to use filters. As for Github, we would also have the challenge of whether to open issues in the WordPress/Drupal/Joomla/Backdrop, 'Packages' repositories, as well as extensions. However, Github does not provide a global view of issues and does not allow moving an issue from one project to another.
+By comparison, JIRA has a lot of very powerful but difficult to use filters. As for Github, we would also have the challenge of whether to open issues in the WordPress/Drupal/Joomla/Backdrop, 'Packages' repositories, as well as extensions. However, Github does not provide a global view of issues and does not allow moving an issue from one project to another.
\ No newline at end of file
+
+## TODO: Security issues: how to add people to security issues (who aren't part of the security team)
+
+This needs more testing!
+
+Gitlab has a per-issue privacy flag, but we would have to ensure that all issues created have that flag. Otherwise, it might be simpler to make the project fully private.
+
+In any case, this needs more testing.
+
+## TODO: Document the account creation, permissions, workflow
+
+* Can a non existing user easily create an account and (issue) report?
+* Who can add labels/assign/add milestone?
+  * Milestones should be added only when the PR is merged. It's impossible to know when issues will be merged, because we release monthly.
\ No newline at end of file