Comment 7 for bug 1842930

Thanks, I'm marking our security advisory task "won't fix" and lifting the private embargo, treating this as a class D report indicating a need for documentation improvements: https://security.openstack.org/vmt-process.html#incident-report-taxonomy