doc: mention where to push security commits

doc/contributing/releases.md

@@ -249,6 +249,14 @@ each commit from the PR. You will also need to manually apply the PR
 metadata (`PR-URL`, `Reviewed-by`, etc.) by amending the commit messages. If
 known, additionally include `CVE-ID: CVE-XXXX-XXXXX` in the commit metadata.
 
+Push the commits to the `vN.x-staging` branch and create the proposal branch
+based on the staging one. Whenever you need to include commits or adjust the
+history, push them to vN.x-staging and rebase your proposal:
+
+```console
+git rebase private/v18.x-staging
+```
+
 **Note**: Do not run CI on the PRs in `nodejs-private` until CI is locked down.
 You can integrate the PRs into the proposal without running full CI.