example/idealized/common workflow, for a vendor
...
Vendor status and statements
vul note/disclosure (point elsewhere for some vul note stuff)- be aware of vul note, review draft, comment/feedback, update vendor status, be aware that vul note is published