docs: point security/CoC reporting at GitHub, not a non-existent README email

Both files told reporters to "email the maintainer listed in the README", but
the README lists no email. Point them at GitHub's private vulnerability
reporting and maintainer contact instead.

Author: mbn-code

CODE_OF_CONDUCT.md

@@ -20,7 +20,7 @@ Examples of unacceptable behavior include:
 Project maintainers are responsible for clarifying standards and will take corrective action where needed.
 
 ## Enforcement
-Instances of abusive, harassing, or otherwise unacceptable behavior may be reported by opening an Issue or emailing the maintainer listed in the README. All complaints will be reviewed and investigated and results communicated back.
+Instances of abusive, harassing, or otherwise unacceptable behavior may be reported by opening an issue or contacting the project maintainers privately through GitHub. All complaints will be reviewed and investigated and results communicated back.
 
 ## Attribution
 This Code of Conduct is adapted from the Contributor Covenant, version 2.1: https://www.contributor-covenant.org/version/2/1/code_of_conduct.html

SECURITY.md

@@ -1,7 +1,11 @@
 # Security Policy
 
 ## Reporting a Vulnerability
-If you discover a security vulnerability in cLog++, please open an Issue marked 'security' or email the maintainer listed in the README. Do **not** disclose it publicly until we have coordinated a fix.
+If you discover a security vulnerability in cLog++, please report it privately
+via GitHub: open the repository's **Security** tab and choose *Report a
+vulnerability* (a private security advisory). If that is unavailable, open an
+Issue labelled `security` with minimal detail and ask for a private channel.
+Please do not disclose the issue publicly until a fix has been coordinated.
 
 ## Supported Versions
 Only the latest release is supported.