I mostly got the wording from Django's docs. I think it makes sense to *not* indicate a CVE number in the commit messages and instead reference it in the mailing list announcements?