[vog]

You may be interested in the experience report of Ted Unangst about fixing security issues in OpenBSD:

http://www.tedunangst.com/flak/post/making-security-sausage