Independent developers contributing packages

[Lucas Albers]

Can someone explain how this new redhat project works with independent
developers?

Let's pick a really cool package that currently exists in redhat.
Severn currently includes spamasssassin 2.55.
Those crazy SA guys are coding up 2.6. When they release 2.6 they usually
release a rpm package.
So one of the SA developers will contact redhat and tell them to include
their rpm in the severn version of redhat?

Does this add potential security problems?
If an independent developer get's their machine hacked and their source
trojaned, will that package sneak into the redhat release?
Are independent developers responsible for security updates?
How does QA work with package developers?

This should speed up the dev cycle.

Does this have less QA built into the package release cycle?

I could not find any documentation concerning this subject.

It appears a developer has to submit their package as a bugzilla entry to
be included in the base release?

In Summary:
What are the steps for an independent developer to get their package into
redhat?

--Luke