Add GitHub private vulnerability reporting info

Update SECURITY.md and docs/sphinx/security.rst to add a "Reporting Vulnerabilities" section that directs users to GitHub private vulnerability reporting (https://github.com/ssh4net/OpenMeta/security/advisories/new). Request a minimal reproducer (file or hex snippet), build flags, and stack trace, and advise against publishing exploit details until a fix is available.

Author: ssh4net

SECURITY.md

@@ -104,8 +104,12 @@ cmake --build build-fuzz
 ./build-fuzz/openmeta_fuzz_exif_tiff_decode -max_total_time=60
 ```
 
-## Reporting
+## Reporting Vulnerabilities
 
-If you find a security issue, please provide a minimal reproducer file (or
-hex snippet), build flags, and stack trace. Avoid publishing exploit details
-until a fix is available.
+If you find a security issue, please use GitHub private vulnerability
+reporting:
+
+- https://github.com/ssh4net/OpenMeta/security/advisories/new
+
+Please provide a minimal reproducer file (or hex snippet), build flags, and
+stack trace. Avoid publishing exploit details until a fix is available.

docs/sphinx/security.rst

@@ -62,4 +62,15 @@ What the tests do
 - Unit tests cover normal and malformed inputs.
 - libFuzzer and FuzzTest targets exercise parsers under sanitizers.
 
+Reporting vulnerabilities
+-------------------------
+
+If you find a security issue, please use GitHub private vulnerability
+reporting:
+
+- https://github.com/ssh4net/OpenMeta/security/advisories/new
+
+Please include a minimal reproducer file (or hex snippet), build flags, and
+stack trace. Avoid publishing exploit details until a fix is available.
+
 For the full policy and threat model, see ``SECURITY.md`` in the repository.