Security Policy Vulnerability reports: open a PRIVATE security advisory. Do not disclose until a coordinated note is published.