Use GitHub private vulnerability reporting to submit security issues.

Private disclosure is supported from day one.

Include the affected version, a description of the issue, and reproduction steps if available.

Response is best effort with no fixed SLA at this stage.