Private security disclosure route?

[dodge1218]

Hi, I found a security issue in this repository and have a source-referenced report ready. I do not see a SECURITY.md or private vulnerability reporting route from the GitHub community profile. Is there a preferred private channel for security reports?\n\nHigh-level, non-sensitive summary only: this concerns a credential/secret handling edge case. I have not opened public exploit details.

[ricmoo]

There is a SECURITY.md file in the root of the repo. But the best way is to contact me@ricmoo.com.

Thanks!