Maybe something lightweight. 1) E-mail the Grape mailing list asking for a project maintainer's direct email address. 2) Talk to them directly.
Activity
tonobo commentedon Feb 10, 2017
Possbilby a dedicated google group for security anouncements? So no infrastructure is required and google group supports rss / atom feeds.