2) Bug numbers: bodhi says it accepts CVE aliases. Hence I entered
CVE-2007-6061 which is an alias for bug 393251. It didn't reject it,
but later on no bug number appeared in my request. If I had known that,
I would have entered the bug number and not the alias.
Instead, and possibly 3), I got internal server error 500 for two
consecutive update requests, although they made it into the system.
4) Security updates: it confuses me a lot that I can choose to push
to stable, but the request is modified to push to "testing" instead.
Apparently, because approval from the security team is needed.
The request then reads "Requested: testing" without any indication
that "stable" was requested.