I created a couple Bug and To Do items under the tracker (http://http://www.gadgetfactory.net/gf/project/butterflylogic/tracker/) section on the project page. I'm not sure if this is the final solution we want to adopt for this type of thing but it was already a part of the project page so I started using it to keep track of issues.
I added three items to the tracker.
Critical:
Add write address range check to the bootloader. Don't allow writes to the beginning (bootloader region) or end (configuration bits). Erase is already protected, but this extra check should be added before shipping a manufactured version.
Post-release:
Increase bootloader speed by changing to page writes instead of word writes.
Implement the SPI interface between PIC and FPGA for faster data downloads. (needs update to SUMP too).