README: add a paragraph about the things we need in a report

README.md

@@ -2,14 +2,23 @@
 
 The OCaml Security Advisory Database is a repository of security advisories filed against the OCaml compiler and OCaml packages published via [opam](https://opam.ocaml.org).
 
-This database is still work in progress, please stay tuned for updates.
-
 It is maintained by the [OCaml security team](https://ocaml.org/security).
 
 ## Receiving Security Advisories
 
 On the public [mailing list ocsf-ocaml-security-announcements](https://sympa.inria.fr/sympa/info/ocsf-ocaml-security-announcements) every security advisory will be published. Everyone can subscribe to that mailing list. It is only for security advisories, there won't be any discussion on the mailing list.
 
+## What is needed in a report about a security issue?
+
+In order to quickly process reports, it is great if you can supply:
+
+- A brief description of the vulnerability,
+- Indication whether you want to stay anonymous or revealing your name (for the upstream authors and advisory),
+- A reproducible example using opam-installed binaries or equivalent,
+- A [CWE](https://cwe.mitre.org/) identifier,
+- A classification [CVSS](https://www.first.org/cvss/calculator/3.1),
+- Indication whether you already requested a CVE number, or want us to do this.
+
 ## Reporting Vulnerabilities
 
 1. Someone (the *reporter*) reports a security issue to [security@ocaml.org](mailto:security@ocaml.org) or as a private GitHub issue in [ocaml/security-advisories](https://github.com/ocaml/security-advisories) repository.