http://tstzmgqansvqfzr3qrkehszmlhjqbpqp7pwncrzr72ohyygrnbuu26qd.onion/articles/libre-software-security-disclosure
This mindset also means keeping the notifications confidential, possibly with encryption, because if it would ever leak you'd end up creating a 0day against your software. To me this is playing with fire but not only. Because it fundamentally cannot work correctly with public licensing where by very definition anyone is a licensee, you could try to notify distribution maintainers ahead, but your list still isn't going to be exhaustive.