Security advisories are currently copied to www.drupal.org just before release. It would be good to have the ability to draft them earlier.
Since advisories won’t be created in the same order they are published, the advisory ID should be set on publish.
This makes the advisory ID field a good indicator of when an advisory is first published. (Very rarely an advisory might be temporarily unpublished and republished, that shouldn‘t reset the creation date.) When the advisory ID is being set on publish, also set the node creation date to the current request time.
Active
3.0
Security advisories
This is now complete.
Release pages like https://www.drupal.org/project/google_tag/releases/2.0.8 → now have a list of security advisories added, so the advisory ID does not need to be known ahead of time for release notes.
The advisory ID behaves as described in the issue summary.