Prioritize security above-all, including your own.

That reads a little oddly. It makes it sound like you want maintainers to risk life and limb, which is not, I think, our intention :)

:)

Changing to "security is your number one priority" to take from the AWS playbook.

You've pulled out some of the specifics of what our labels currently are. Considering we're iterating on them, that might be smart (I'd hate to roll this out to 25+ repos and decide we wanted to change from "minor" to "trivial" or something like that..

What do you think of a putting out a separate doc with label information into .github?

It's a good idea. I think I'd like to leave this text as is for now as it says "For example, .." but as we try to standardize labels we can extract.

You've cut out the "how" here of how we want to do this. I think it's important that we don't assume people know what the tags should be or what the branches should be.

So similar comment to above -- should the "hows" be in separate documents that live in github? I had rolled the what you do and how you do it together in my maintainer doc. But I'm not religious about keeping it that way, as long both are covered somewhere.

We can't possibly spell the detailed how's in the template repository because YMMV across repos. How about accepting this as a start or suggest what additional text will bring it to par with minimum expectations?

Again -- how? I think we need to write down how you release and when we plan to do it.

This should say "see releasing", but since it doesn't exist we can't spell it out now and I don't want to boil the ocean.

I like this whole doc :)