Respecting maintainer time should be in security policies