Security bug handling for Hurd glibc

Do you think we need embargoes for Hurd-specific security
vulnerabilities in glibc?

Privately reported security bugs would allow Hurd developers to prepare
fixes before vulnerabilities are disclosed.  But they come with
significant overhead because the regular project structure cannot be
used.

Background: Someone ran a poorly aligned AI on RHEL glibc sources, and
it found a bunch of vulnerabilities in the Hurd part.  I'm not entirely
sure if they are real bugs (at least some of them probably are; tool
produces reasonable results otherwise).  I don't want the reports to go
to waste, but I'd prefer to handle them as efficient as possible.

Thanks,
Florian