Steven, while it's not ideal to have a public fix for a private bug, for what it worth, the advance notification (pre-OSSA) can reference public review numbers. If both bugs 1508115 and bug 1496277 can be fixed with one patch, I'd say it's ok to do so directly on gerrit, as long as the security implication is not obvious.
However we need to make sure all the required piece to fix this bug are identified and referenced so that stakeholders can apply the fix.
Steven, while it's not ideal to have a public fix for a private bug, for what it worth, the advance notification (pre-OSSA) can reference public review numbers. If both bugs 1508115 and bug 1496277 can be fixed with one patch, I'd say it's ok to do so directly on gerrit, as long as the security implication is not obvious.
However we need to make sure all the required piece to fix this bug are identified and referenced so that stakeholders can apply the fix.