I promise at least to reply to all release-critical bugs in my packages as soon as I am able to do so, and, if they take some time to fix, to post regular updates to the bug report. If you find a release-critical bug in one of my packages that hasn't seen any comments from me for two weeks, or if my vacation field in the developer database is set and I don't respond for two days, you have my permission to take action to fix it yourself.
To avoid duplicated effort, please mail a note to the bug report saying that you intend to NMU, then, when you've prepared a fix, mail the patch to the bug report and upload it. The UK timezone is such that if I'm around and have any objections I can either respond to your first mail or otherwise take action before dinstall runs.
For my non-release-critical bugs, just mail me and ask if you're concerned about any of them. Unless I have special ideas, which I hope should be recorded in the bug, I probably won't object to someone else helping out. If it takes me an unreasonable time to respond (months) and I seem to be otherwise missing from the project (check the database and ask on #debian-devel), go with the developer's reference and eventually contact debian-private.
Special cases:
Of course, I hope that none of these measures will ever need to be invoked!
Colin Watson <cjwatson@debian.org>